diff options
| -rw-r--r-- | README.md | 19 | ||||
| -rw-r--r-- | cgit/40-fcgiwrap.sh | 10 | ||||
| -rw-r--r-- | cgit/Dockerfile | 23 | ||||
| -rw-r--r-- | cgit/cgitrc | 7 | ||||
| -rw-r--r-- | cgit/site.template | 22 | ||||
| -rw-r--r-- | docker-compose-setup.yml | 15 | ||||
| -rw-r--r-- | docker-compose.yml | 21 | ||||
| -rw-r--r-- | gitolite/Dockerfile | 30 | ||||
| -rw-r--r-- | gitolite/docker-entrypoint.sh | 44 | ||||
| -rw-r--r-- | init.sh | 21 |
10 files changed, 212 insertions, 0 deletions
diff --git a/README.md b/README.md new file mode 100644 index 0000000..e4d319f --- /dev/null +++ b/README.md @@ -0,0 +1,19 @@ +# githost + +A docker-compose provisioned gitolite+cgit+nginx setup. + +## Setup + +Run +``` +sh ./init.sh +``` +This will generate a new keypair in the local directory, and add it to a `.env` +file. Type a password for the new ssh-keypair. + +## Local development + +When you've upped the containers you can clone the githost-admin repo with +``` +git clone git@localhost:gitolite-admin.git --config core.sshCommand="ssh -i PATH_TO_PRIVATE_KEY -p 2222" +``` diff --git a/cgit/40-fcgiwrap.sh b/cgit/40-fcgiwrap.sh new file mode 100644 index 0000000..3f788af --- /dev/null +++ b/cgit/40-fcgiwrap.sh @@ -0,0 +1,10 @@ +#!/bin/sh +set -ex + +# start fastcgiwrap +rm -f /run/fcgiwrap.socket +nohup fcgiwrap -s unix:/run/fcgiwrap.socket & +while ! [ -S /run/fcgiwrap.socket ]; do sleep .2; done +chown nginx:www-data /run/fcgiwrap.socket +#chmod g+rwx /run/fcgiwrap.socket +#test -f nohup.out && rm -f ./nohup.out diff --git a/cgit/Dockerfile b/cgit/Dockerfile new file mode 100644 index 0000000..e89b8d3 --- /dev/null +++ b/cgit/Dockerfile @@ -0,0 +1,23 @@ +FROM nginx:1.29.7-alpine-slim +ARG DOMAIN=localhost + +RUN set -x \ + && apk add --no-cache cgit fcgiwrap envsubst + +RUN apk update && apk update + +COPY 40-fcgiwrap.sh /docker-entrypoint.d/ +RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh + +COPY cgitrc /etc/ + +COPY site.template / +RUN sed "s/\$DOMAIN/$DOMAIN/g" /site.template > /etc/nginx/conf.d/default.conf +RUN rm /site.template + +RUN addgroup nginx www-data + +#RUN sed -i -Ee 's/pid\s+.*;/pid \/tmp\/nginx.pid;/' /etc/nginx/nginx.conf +#RUN sed -i -Ee 's/error_log\s+.*;/error_log \/dev\/stdout;/' /etc/nginx/nginx.conf +# +#USER nginx diff --git a/cgit/cgitrc b/cgit/cgitrc new file mode 100644 index 0000000..ecd0083 --- /dev/null +++ b/cgit/cgitrc @@ -0,0 +1,7 @@ +# Needed to avoid duplicating URI in every href +virtual-root=/ + +scan-path=/var/lib/git/repositories +project-list=/var/lib/git/projects.list +#enable-index-links=1 +repo.ignore=1 diff --git a/cgit/site.template b/cgit/site.template new file mode 100644 index 0000000..c1962d9 --- /dev/null +++ b/cgit/site.template @@ -0,0 +1,22 @@ +server { + server_name $DOMAIN; + + listen [::]:80; + listen 80; + + access_log /var/log/nginx/cgit-access.log; + error_log /var/log/nginx/cgit-error.log; + + root /usr/share/webapps/cgit; + try_files $uri @cgit; + + location @cgit { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi; + fastcgi_pass unix:/run/fcgiwrap.socket; + + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; + } +} diff --git a/docker-compose-setup.yml b/docker-compose-setup.yml new file mode 100644 index 0000000..da619ac --- /dev/null +++ b/docker-compose-setup.yml @@ -0,0 +1,15 @@ +services: + gitolite: + build: gitolite + environment: + - SSH_KEY=${SSH_KEY} + - SSH_KEY_NAME=${SSH_KEY_NAME} + volumes: + - gitolite-sshkeys:/etc/ssh/keys + - gitolite-git:/var/lib/git + command: ["true"] + +volumes: + gitolite-sshkeys: + gitolite-git: + diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..b257e99 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,21 @@ +services: + gitolite: + build: gitolite + ports: + - 2222:22 + volumes: + - gitolite-sshkeys:/etc/ssh/keys + - gitolite-git:/var/lib/git + cgit: + build: cgit + environment: + - DOMAIN=${DOMAIN} + ports: + - 8080:80 + volumes: + - gitolite-git:/var/lib/git + #command: ["nginx-debug"] + +volumes: + gitolite-sshkeys: + gitolite-git: diff --git a/gitolite/Dockerfile b/gitolite/Dockerfile new file mode 100644 index 0000000..f6749f7 --- /dev/null +++ b/gitolite/Dockerfile @@ -0,0 +1,30 @@ +FROM alpine:3.23.3 + +# Install OpenSSH server and Gitolite +# Unlock the automatically-created git user +RUN set -x \ + && apk add --no-cache openrc fail2ban gitolite openssh + +RUN apk update && apk update + +RUN rc-update add fail2ban + +RUN git config --system advice.defaultBranchName false + +# Volume used to store SSH host keys, generated on first run +VOLUME /etc/ssh/keys + +# Volume used to store all Gitolite data (keys, config and repositories), initialized on first run +VOLUME /var/lib/git + +# Entrypoint responsible for SSH host keys generation, and Gitolite data initialization +COPY docker-entrypoint.sh / +RUN chmod +x /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +# Expose port 22 to access SSH +EXPOSE 22 + +# Default command is to run the SSH server + +CMD ["sshd"] diff --git a/gitolite/docker-entrypoint.sh b/gitolite/docker-entrypoint.sh new file mode 100644 index 0000000..94717eb --- /dev/null +++ b/gitolite/docker-entrypoint.sh @@ -0,0 +1,44 @@ +#!/bin/sh + +set -ex + +# if command is sshd, set it up correctly +if [ "${1}" = 'sshd' ]; then + set -- /usr/sbin/sshd -D + + # Setup SSH HostKeys if needed + for algorithm in rsa ecdsa ed25519 + do + keyfile=/etc/ssh/keys/ssh_host_${algorithm}_key + [ -f $keyfile ] || ssh-keygen -q -N '' -f $keyfile -t $algorithm + grep -q "HostKey $keyfile" /etc/ssh/sshd_config || echo "HostKey $keyfile" >> /etc/ssh/sshd_config + done + # Disable unwanted authentications + perl -i -pe 's/^#?((?!Kerberos|GSSAPI|Password)\w*Authentication)\s.*/\1 no/; s/^(PubkeyAuthentication) no/\1 yes/' /etc/ssh/sshd_config + perl -i -pe 's/^#?(PermitRootLogin)\s.*/\1 no/' /etc/ssh/sshd_config + # Disable sftp subsystem + perl -i -pe 's/^(Subsystem\ssftp\s)/#\1/' /etc/ssh/sshd_config +fi + +# Fix permissions at every startup +chown -R git:git ~git + +# Setup gitolite admin +if [ ! -f ~git/.ssh/authorized_keys ]; then + if [ -n "$SSH_KEY" ]; then + [ -n "$SSH_KEY_NAME" ] || SSH_KEY_NAME=admin + echo "$SSH_KEY" > "/tmp/$SSH_KEY_NAME.pub" + su - git -c "gitolite setup -pk \"/tmp/$SSH_KEY_NAME.pub\"" + rm "/tmp/$SSH_KEY_NAME.pub" + else + echo "You need to specify SSH_KEY on first run to setup gitolite" + echo "You can also use SSH_KEY_NAME to specify the key name (optional)" + echo 'Example: docker run -e SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" -e SSH_KEY_NAME="$(whoami)" jgiannuzzi/gitolite' + exit 1 + fi +# Check setup at every startup +else + su - git -c "gitolite setup" +fi + +exec "$@" @@ -0,0 +1,21 @@ +#!/usr/bin/env sh +set -e + +# Only create a new keypair if one does not exist +! [ -f "$(whoami).pub" ] && ssh-keygen -f $(whoami) -t rsa -b 4096 + +# Add the keyname and public key to .env file +echo "SSH_KEY='$(cat $(whoami).pub)'" > .env +echo "SSH_KEY_NAME='$(whoami)'" >> .env + +DOMAIN="localhost" +echo -n "Enter a domain [${DOMAIN}]: " +read ENTRY_DOMAIN +DOMAIN="${ENTRY_DOMAIN:-$DOMAIN}" +echo "DOMAIN=${DOMAIN}" >> .env + +# Build the image, and run initial setup +docker-compose build gitolite +docker-compose -f docker-compose-setup.yml up -d gitolite +echo "All set." +echo "Start the containers with docker-compose up -d" |