diff options
| -rw-r--r-- | doc/forge.skb | 4 | ||||
| -rw-r--r-- | guix/forge/cgit.scm | 86 |
2 files changed, 51 insertions, 39 deletions
diff --git a/doc/forge.skb b/doc/forge.skb index 4f184ae..7a41487 100644 --- a/doc/forge.skb +++ b/doc/forge.skb @@ -243,7 +243,9 @@ programming languages using ,(ref :url "https://pygments.org/" :text "Pygments")]) (item [rendering markdown, org mode, reStructuredText, man page, HTML or plain text README files in the ,(emph [About]) page]) - (item [hiding full email addresses on cgit web pages])) + (item [hiding full email addresses on cgit web pages]) + (item [,(ref :url "https://anubis.techaro.lol/" :text "Anubis") +protection for expensive endpoints])) [Note that this service is different from the cgit service of the same name in Guix upstream.]) (description diff --git a/guix/forge/cgit.scm b/guix/forge/cgit.scm index 2f6598f..94a62ee 100644 --- a/guix/forge/cgit.scm +++ b/guix/forge/cgit.scm @@ -30,7 +30,8 @@ #:use-module (gnu services) #:use-module ((gnu services web) #:select (nginx-server-configuration nginx-location-configuration - nginx-named-location-configuration)) + nginx-named-location-configuration + nginx-named-location-configuration-body)) #:use-module (gnu system file-systems) #:use-module (guix gexp) #:use-module (guix records) @@ -252,47 +253,56 @@ configured in @var{config}." (define cgit-nginx-server-block (match-record-lambda <cgit-configuration> (cgit git server-name socket repository-directory) - (nginx-server-configuration + (forge-nginx-server-configuration (server-name (list server-name)) ;; cgit static files (root (file-append cgit "/share/cgit")) + (anubis? #t) (locations - (list - ;; git-http-backend for the smart HTTP protocol - (nginx-location-configuration - (uri "~ ^/.*/(HEAD|info/refs|git-receive-pack|git-upload-pack).*$") - (body (list "fastcgi_param SCRIPT_FILENAME " - (file-append git "/libexec/git-core/git-http-backend;") - (string-append "fastcgi_param GIT_PROJECT_ROOT " - repository-directory - ";") - "fastcgi_param GIT_HTTP_EXPORT_ALL yes;" - "fastcgi_param PATH_INFO $uri;" - "fastcgi_param QUERY_STRING $query_string;" - "fastcgi_param REQUEST_METHOD $request_method;" - "fastcgi_param CONTENT_TYPE $content_type;" - (string-append "fastcgi_pass " - (nginx-socket->string socket) - ";")))) - ;; cgit web interface - (nginx-named-location-configuration - (name "cgit") - (body (list - #~(string-append "fastcgi_param SCRIPT_FILENAME " - #$(file-append cgit "/lib/cgit/cgit.cgi") - ";") - "fastcgi_param PATH_INFO $uri;" - "fastcgi_param QUERY_STRING $query_string;" - "fastcgi_param HTTP_HOST $server_name;" - (string-append "fastcgi_pass " - (nginx-socket->string socket) - ";")))) - ;; On other URIs, try a file before falling back to @cgit. This try_files - ;; cannot be in the server context because it would then apply to - ;; git-http-backend, etc. - (nginx-location-configuration - (uri "/") - (body (list "try_files $uri @cgit;")))))))) + (let ((cgit-location + (nginx-named-location-configuration + (name "cgit") + (body (list + #~(string-append "fastcgi_param SCRIPT_FILENAME " + #$(file-append cgit "/lib/cgit/cgit.cgi") + ";") + "fastcgi_param PATH_INFO $uri;" + "fastcgi_param QUERY_STRING $query_string;" + "fastcgi_param HTTP_HOST $server_name;" + (string-append "fastcgi_pass " + (nginx-socket->string socket) + ";")))))) + (list + ;; git-http-backend for the smart HTTP protocol + (nginx-location-configuration + (uri "~ ^/.*/(HEAD|info/refs|git-receive-pack|git-upload-pack).*$") + (body (list "fastcgi_param SCRIPT_FILENAME " + (file-append git "/libexec/git-core/git-http-backend;") + (string-append "fastcgi_param GIT_PROJECT_ROOT " + repository-directory + ";") + "fastcgi_param GIT_HTTP_EXPORT_ALL yes;" + "fastcgi_param PATH_INFO $uri;" + "fastcgi_param QUERY_STRING $query_string;" + "fastcgi_param REQUEST_METHOD $request_method;" + "fastcgi_param CONTENT_TYPE $content_type;" + (string-append "fastcgi_pass " + (nginx-socket->string socket) + ";")))) + ;; cgit web interface + cgit-location + ;; Protect the commit, diff and tree URIs behind Anubis. + (nginx-location-configuration + (uri "~ ^/.*/(diff|tree)/") + (body (cons* "auth_request /.within.website/x/cmd/anubis/api/check;" + "error_page 401 = @redirectToAnubis;" + (nginx-named-location-configuration-body cgit-location)))) + ;; On other URIs, try a file before falling back to @cgit. This + ;; try_files cannot be in the server context because it would then + ;; apply to git-http-backend, etc. + (nginx-location-configuration + (uri "/") + (body (list "try_files $uri @cgit;"))))))))) (define cgit-service-type (service-type |