Unify docker image

This makes it easier to manage and unifies the services that essentially
belong together. Might consider making it a split configuration again
later, but for now it makes much more sense such that fail2ban can
better operate with all the available logs instead of managing the
circus that is docker volumes.

13 files changed, 355 insertions, 8 deletions

diff --git a/gitolite/Dockerfile b/gitolite/Dockerfile
index 8ac87f6..44af1f0 100644
--- a/gitolite/Dockerfile
+++ b/gitolite/Dockerfile
@@ -1,27 +1,109 @@
+# Compile cgit
+FROM alpine:3.23.3 AS build
+
+RUN set -x \
+ && apk add --no-cache gcc g++ cmake make curl linux-headers musl-dev zlib-dev libressl-dev libintl musl-libintl
+
+# Compile cgit
+RUN set -x \
+ && wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
+ && tar -xvf cgit-1.3.tar.xz \
+ && make -C /cgit-1.3 get-git \
+ && DESTDIR=/pkg NO_REGEX=NeedsStartEnd make -C /cgit-1.3 install
+
+
+ #&& tar -czvf deps.tar.gz -C /cgit-1.3/pkg .
+
+
+# Compile cmark-gfm
+RUN set -x \
+  && wget https://github.com/github/cmark-gfm/archive/refs/tags/0.29.0.gfm.13.tar.gz \
+  && tar -xvf 0.29.0.gfm.13.tar.gz \
+  && cmake -S /cmark-gfm-0.29.0.gfm.13 -B /cmark-gfm-0.29.0.gfm.13/build \
+    -DCMAKE_POLICY_VERSION_MINIMUM=4.0 -DCMAKE_INSTALL_PREFIX=pkg \
+  && cmake --build /cmark-gfm-0.29.0.gfm.13/build \
+  && cmake --install /cmark-gfm-0.29.0.gfm.13/build
+
+RUN set -x \
+  && tar -czvf deps.tar.gz -C pkg .
+
+# Configure nginx & cgit + fcgiwrap
 FROM alpine:3.23.3
+COPY --from=build /deps.tar.gz /deps.tar.gz
+
+ARG DOMAIN=localhost
 
-# Install OpenSSH server and Gitolite
-# Unlock the automatically-created git user
 RUN set -x \
- && apk add --no-cache openrc fail2ban gitolite openssh
+ && apk add --no-cache \
+   curl cmark fail2ban fcgiwrap gcc gitolite libintl libressl-dev linux-headers \
+   make musl-dev musl-libintl nginx openrc openssh py3-pygments zlib-dev \
+ && tar -xvf /deps.tar.gz
 
-RUN apk update && apk update
+RUN apk update \
+ && apk upgrade --no-cache \
+ && sed -i '/getty/d' /etc/inittab
 
-RUN rc-update add fail2ban
+COPY cgit/40-fcgiwrap.sh /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh
 
-RUN git config --system advice.defaultBranchName false
+COPY cgit/cgitrc /etc/
+
+COPY cgit/nginx.conf /
+RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/http.d/default.conf \
+  && rm /nginx.conf
+
+RUN addgroup nginx www-data
+
+COPY cgit/about.html /var/www/htdocs/cgit/
+COPY cgit/cgit.png /var/www/htdocs/cgit/logo.png
+COPY cgit/favicon.ico /var/www/htdocs/cgit/
+
+COPY cgit/css_variable_colors.sh /
+COPY cgit/everforest.css /var/www/htdocs/cgit/
+RUN sh css_variable_colors.sh
+
+COPY cgit/about-formatting.sh /usr/local/lib/cgit/filters/about-formatting.sh
+RUN chmod 755 /usr/local/lib/cgit/filters/about-formatting.sh
 
 # Volume used to store SSH host keys, generated on first run
 VOLUME /etc/ssh/keys
 
+RUN rc-update add fail2ban \
+ && rc-update add fcgiwrap \
+ && rc-update add nginx \
+ && rc-update add sshd
+
+# www-data may not be necessary
+RUN addgroup fcgiwrap git
+#RUN usermod -G nginx,www-data,git nginx
+# Configure gitolite
+# Install OpenSSH server and Gitolite
+# Unlock the automatically-created git user
+
+#RUN addgroup -g 102 -S git \
+# && adduser -S -D -H -u 102 -h /var/lib/git -s /sbin/nologin -G git -g git git
+
+RUN git config --system advice.defaultBranchName false
+
 # Volume used to store all Gitolite data (keys, config and repositories), initialized on first run
 VOLUME /var/lib/git
+RUN chmod 750 /var/lib/git
+
+# Disable unwanted authentications and Disable sftp subsystem
+RUN perl -i -pe 's/^#?((?!Kerberos|GSSAPI|Password)\w*Authentication)\s.*/\1 no/;s/^(PubkeyAuthentication) no/\1 yes/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^#?(PermitRootLogin)\s.*/\1 no/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^(Subsystem\ssftp\s)/#\1/' /etc/ssh/sshd_config
+
 
 # Permissions are fixed in docker-entrypoint.sh
 RUN mkdir -p /var/lib/git/local/hooks/common
 COPY post-receive /var/lib/git/local/hooks/common/
 RUN chmod +x /var/lib/git/local/hooks/common/post-receive
 
+# Configure nginx & cgit + fcgiwrap
+#RUN addgroup -g 101 -S nginx \
+# && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx
+
 # Entrypoint responsible for SSH host keys generation, and Gitolite data initialization
 COPY docker-entrypoint.sh /
 RUN chmod +x /docker-entrypoint.sh
@@ -31,4 +113,6 @@ ENTRYPOINT ["/docker-entrypoint.sh"]
 EXPOSE 22
 
 # Default command is to run the SSH server
-CMD ["sshd"]
+#CMD ["sshd"]
+#CMD ["/sbin/init"]
+CMD ["/sbin/init"]
diff --git a/gitolite/cgit/40-fcgiwrap.sh b/gitolite/cgit/40-fcgiwrap.sh
new file mode 100644
index 0000000..3f788af
--- /dev/null
+++ b/gitolite/cgit/40-fcgiwrap.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -ex
+
+# start fastcgiwrap
+rm -f /run/fcgiwrap.socket
+nohup fcgiwrap -s unix:/run/fcgiwrap.socket &
+while ! [ -S /run/fcgiwrap.socket ]; do sleep .2; done
+chown nginx:www-data /run/fcgiwrap.socket
+#chmod g+rwx /run/fcgiwrap.socket
+#test -f nohup.out && rm -f ./nohup.out
diff --git a/gitolite/cgit/Dockerfile b/gitolite/cgit/Dockerfile
new file mode 100644
index 0000000..0c41144
--- /dev/null
+++ b/gitolite/cgit/Dockerfile
@@ -0,0 +1,50 @@
+FROM nginx:1.29.7-alpine-slim AS build
+
+RUN set -x \
+ && apk add --no-cache gcc make curl linux-headers musl-dev zlib-dev libressl-dev libintl musl-libintl
+
+RUN wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
+ && tar -xvf cgit-1.3.tar.xz
+
+WORKDIR /cgit-1.3
+RUN make get-git \
+ && DESTDIR=pkg NO_REGEX=NeedsStartEnd make install
+
+WORKDIR /cgit-1.3/pkg
+RUN tar -czvf cgit-1.3.tar.gz .
+
+
+FROM nginx:1.29.7-alpine-slim
+COPY --from=build /cgit-1.3/pkg/cgit-1.3.tar.gz /cgit-1.3.tar.gz
+
+ARG DOMAIN=localhost
+
+RUN set -x \
+ && apk add --no-cache fcgiwrap py3-pygments \
+ && tar -xvf /cgit-1.3.tar.gz
+
+RUN apk update && apk update
+
+COPY 40-fcgiwrap.sh /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh
+
+COPY cgitrc /etc/
+
+COPY nginx.conf /
+RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/conf.d/default.conf
+RUN rm /nginx.conf
+
+RUN addgroup nginx www-data
+
+COPY about.html /var/www/htdocs/cgit/
+COPY cgit.png /var/www/htdocs/cgit/logo.png
+COPY favicon.ico /var/www/htdocs/cgit/
+
+COPY css_variable_colors.sh /
+COPY everforest.css /var/www/htdocs/cgit/
+RUN sh css_variable_colors.sh
+
+#RUN sed -i -Ee 's/pid\s+.*;/pid \/tmp\/nginx.pid;/' /etc/nginx/nginx.conf
+#RUN sed -i -Ee 's/error_log\s+.*;/error_log \/dev\/stdout;/' /etc/nginx/nginx.conf
+#
+#USER nginx
diff --git a/gitolite/cgit/about-formatting.sh b/gitolite/cgit/about-formatting.sh
new file mode 100644
index 0000000..0cd0e5d
--- /dev/null
+++ b/gitolite/cgit/about-formatting.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# This may be used with the about-filter or repo.about-filter setting in cgitrc.
+# It passes formatting of about pages to differing programs, depending on the usage.
+
+# Markdown support requires python and markdown-python.
+# RestructuredText support requires python and docutils.
+# Man page support requires groff.
+
+# The following environment variables can be used to retrieve the configuration
+# of the repository for which this script is called:
+# CGIT_REPO_URL        ( = repo.url       setting )
+# CGIT_REPO_NAME       ( = repo.name      setting )
+# CGIT_REPO_PATH       ( = repo.path      setting )
+# CGIT_REPO_OWNER      ( = repo.owner     setting )
+# CGIT_REPO_DEFBRANCH  ( = repo.defbranch setting )
+# CGIT_REPO_SECTION    ( = section        setting )
+# CGIT_REPO_CLONE_URL  ( = repo.clone-url setting )
+
+cd "$(dirname $0)/html-converters/"
+case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in
+        *.markdown|*.mdown|*.md|*.mkd) cmark-gfm --to html \
+          -e footnotes \
+          -e table \
+          -e strikethrough \
+          -e autolink \
+          -e tagfilter \
+          -e tasklist \
+          --width 80 <(cat -); ;;
+        *.rst) exec ./rst2html; ;;
+        *.[1-9]) exec ./man2html; ;;
+        *.htm|*.html) exec cat; ;;
+        *.txt|*) exec ./txt2html; ;;
+esac
diff --git a/gitolite/cgit/about.html b/gitolite/cgit/about.html
new file mode 100644
index 0000000..ede0cb5
--- /dev/null
+++ b/gitolite/cgit/about.html
@@ -0,0 +1,4 @@
+<h2>Disclaimer</h2>
+I request that none of this code, in part or in full, be hosted on Github,
+Sourceforge, or any other proprietary platform. This request is made out of
+respect for both me, the developer and for you, the user.
diff --git a/gitolite/cgit/cgit.png b/gitolite/cgit/cgit.png
new file mode 100644
index 0000000..65cb7da
--- /dev/null
+++ b/gitolite/cgit/cgit.png
diff --git a/gitolite/cgit/cgitrc b/gitolite/cgit/cgitrc
new file mode 100644
index 0000000..cbfa6a9
--- /dev/null
+++ b/gitolite/cgit/cgitrc
@@ -0,0 +1,37 @@
+repository-sort=age
+clone-url=https://$HTTP_HOST$SCRIPT_NAME/$CGIT_REPO_URL
+enable-http-clone=1
+
+# Needed to avoid duplicating URI in every href
+virtual-root=/
+
+# Extra <head>
+head-include=/usr/lib/cgit/include.html
+
+# Enable us "ignoring" specific repositories
+enable-git-config=1
+
+# Self explanatory
+enable-http-clone=1
+
+# Remove .git suffix
+remove-suffix=1
+
+readme=:README.md
+about-filter=/usr/local/lib/cgit/filters/about-formatting.sh
+
+# Needs to be mountpoint of the gitolite volume
+project-list=/var/lib/git/projects.list
+scan-path=/var/lib/git/repositories
+
+# Requires python
+#source-filter=/usr/lib/cgit/filters/syntax-high.py
+
+root-title=Personal projects
+root-desc=A brief collection
+root-readme=/var/www/htdocs/cgit/about.html
+local-time=1
+
+css=/everforest.css
+css=/cgit.css
+logo=/logo.png
diff --git a/gitolite/cgit/css_variable_colors.sh b/gitolite/cgit/css_variable_colors.sh
new file mode 100644
index 0000000..fbab0cc
--- /dev/null
+++ b/gitolite/cgit/css_variable_colors.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+CGIT_CSS_PATH=/var/www/htdocs/cgit/cgit.css
+sed -i -Ee 's/\<white\>/var(--color-bg)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<blue\>/var(--color-accent)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<black\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+# Diffs?
+sed -i -Ee 's/\<green\>/var(--color-green)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#009\>/var(--color-blue)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<red\>/var(--color-red)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#333\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#ccc\>/var(--color-bg-2)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#000\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#777\>/var(--color-white)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#f7f7f7\>/var(--color-bg-1)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#eee\>/var(--color-bg-2)/g' "${CGIT_CSS_PATH}"
+
+# links
+sed -i -Ee 's/#00f\>/var(--color-accent)/g' "${CGIT_CSS_PATH}"
+
+# ago, minutes, hours
+sed -i -Ee 's/#080\>/var(--color-blue)/g' "${CGIT_CSS_PATH}"
+# ago, days
+sed -i -Ee 's/#040\>/var(--color-green)/g' "${CGIT_CSS_PATH}"
+# ago, weeks
+sed -i -Ee 's/#444\>/var(--color-yellow)/g' "${CGIT_CSS_PATH}"
+# ago, months
+sed -i -Ee 's/#888\>/var(--color-bg-yellow)/g' "${CGIT_CSS_PATH}"
+# ago, years
+sed -i -Ee 's/#bbb\>/var(--color-grey)/g' "${CGIT_CSS_PATH}"
diff --git a/gitolite/cgit/everforest.css b/gitolite/cgit/everforest.css
new file mode 100644
index 0000000..46333e3
--- /dev/null
+++ b/gitolite/cgit/everforest.css
@@ -0,0 +1,61 @@
+:root {
+  --color-bg-dim:      #1e2326;
+  --color-bg-0:        #272e33;
+  --color-bg-1:        #2e383c;
+  --color-bg-2:        #374145;
+  --color-bg-3:        #414b50;
+  --color-bg-4:        #495156;
+  --color-bg-5:        #4f5b58;
+  --color-bg-red:      #493b40;
+  --color-bg-yellow:   #45443c;
+  --color-bg-green:    #3c4841;
+  --color-bg-blue:     #384b55;
+  --color-bg-purple:   #463f48;
+  --color-bg-visual:   #4c3743;
+
+  /* Regular */
+  --color-fg:       #d3c6aa;
+  --color-red:      #e67e80;
+  --color-yellow:   #dbbc7f;
+  --color-green:    #a7c080;
+  --color-blue:     #7fbbb3;
+  --color-purple:   #d699b6;
+  --color-aqua:     #83c092;
+  --color-orange:   #e69875;
+  --color-grey-0:   #7a8478;
+  --color-grey-1:   #859289;
+  --color-grey-2:   #9da9a0;
+  --color-grey:     var(--color-grey-2);
+
+  --color-black:     var(--color-bg-dim);
+  --color-turquoise: var(--color-aqua);
+  --color-white:     var(--color-grey);
+
+
+  --color-bg:     var(--color-bg-0);
+  --color-fg-sel: var(--color-fg);
+  --color-bg-sel: var(--color-bg-visual);
+
+  --color-accent:      var(--color-green);
+  --color-header-0:    var(--color-red);
+  --color-header-1:    var(--color-orange);
+  --color-header-2:    var(--color-yellow);
+  --color-header-3:    var(--color-green);
+  --color-header-4:    var(--color-blue);
+  --color-header-5:    var(--color-purple);
+  --color-header-delim:var(--color-grey-1);
+
+  --color-list-point-0:    var(--color-red);
+  --color-list-point-1:    var(--color-orange);
+  --color-list-point-2:    var(--color-yellow);
+  --color-list-point-3:    var(--color-green);
+  --color-list-point-4:    var(--color-blue);
+  --color-list-point-5:    var(--color-purple);
+
+  --color-var(--color-blue):
+}
+
+body {
+  background-color: var(--color-bg);
+  color: var(--color-fg);
+}
diff --git a/gitolite/cgit/favicon.ico b/gitolite/cgit/favicon.ico
new file mode 100644
index 0000000..f4d51ba
--- /dev/null
+++ b/gitolite/cgit/favicon.ico
diff --git a/gitolite/cgit/favicon.png b/gitolite/cgit/favicon.png
new file mode 100644
index 0000000..da6269e
--- /dev/null
+++ b/gitolite/cgit/favicon.png
diff --git a/gitolite/cgit/nginx.conf b/gitolite/cgit/nginx.conf
new file mode 100644
index 0000000..f4a115b
--- /dev/null
+++ b/gitolite/cgit/nginx.conf
@@ -0,0 +1,22 @@
+server {
+    server_name $DOMAIN;
+
+    listen [::]:80;
+    listen 80;
+
+    access_log  /var/log/nginx/cgit-access.log;
+    error_log   /var/log/nginx/cgit-error.log;
+
+    root /var/www/htdocs/cgit;
+    try_files $uri @cgit;
+
+    location @cgit {
+        include          fastcgi_params;
+        fastcgi_param    SCRIPT_FILENAME /var/www/htdocs/cgit/cgit.cgi;
+        fastcgi_pass     unix:/run/fcgiwrap/fcgiwrap.sock;
+
+        fastcgi_param    PATH_INFO    $uri;
+        fastcgi_param    QUERY_STRING $args;
+        fastcgi_param    HTTP_HOST    $server_name;
+    }
+}
diff --git a/gitolite/docker-entrypoint.sh b/gitolite/docker-entrypoint.sh
index 3d08d34..d83d9e0 100644
--- a/gitolite/docker-entrypoint.sh
+++ b/gitolite/docker-entrypoint.sh
@@ -42,8 +42,18 @@ else
   su - git -c "gitolite setup"
 fi
 
+su - git -c "chmod 750 ~git/repositories"
+su - git -c "chmod 640 ~git/projects.list"
+
 if [ "${1}" != 'sshd' ]; then
-  sed -i -Ee "s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'cgit.*',/" /var/lib/git/.gitolite.rc
+ #         LOCAL_CODE                =>  "$ENV{HOME}/local",
+
+    su - git -c "sed -i -Ee \"s/^([^#]*UMASK\\s*=>\\s*)[0-9]*\\s*,/\\1 0027,/\" /var/lib/git/.gitolite.rc"
+    su - git -c "sed -i -Ee \"s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'.*',/\" /var/lib/git/.gitolite.rc"
+    #su - git -c "sed -i -Ee 's/#?(\\s*LOCAL_CODE\\s+=>\\s+\"\\\$ENV\\{HOME\\}\\/local\",.*)/\\1/' ~/.gitolite.rc"
+    #su - git -c "chmod 650 ~git/repositories"
+    #su - git -c "chmod 640 ~git/projects.list"
+  #sed -i -Ee "s/^([^#]*UMASK\\s*=>)\\s*'[^']*'\\s*,/\\1 0027,/" /var/lib/git/.gitolite.rc
   #sed -i -Ee "s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'.*',/" /var/lib/git/.gitolite.rc
 fi