13 files changed, 355 insertions, 8 deletions
diff --git a/gitolite/Dockerfile b/gitolite/Dockerfile
index 8ac87f6..44af1f0 100644
--- a/gitolite/Dockerfile
+++ b/gitolite/Dockerfile
@@ -1,27 +1,109 @@
+# Compile cgit
+FROM alpine:3.23.3 AS build
+
+RUN set -x \
+ && apk add --no-cache gcc g++ cmake make curl linux-headers musl-dev zlib-dev libressl-dev libintl musl-libintl
+
+# Compile cgit
+RUN set -x \
+ && wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
+ && tar -xvf cgit-1.3.tar.xz \
+ && make -C /cgit-1.3 get-git \
+ && DESTDIR=/pkg NO_REGEX=NeedsStartEnd make -C /cgit-1.3 install
+
+
+ #&& tar -czvf deps.tar.gz -C /cgit-1.3/pkg .
+
+
+# Compile cmark-gfm
+RUN set -x \
+  && wget https://github.com/github/cmark-gfm/archive/refs/tags/0.29.0.gfm.13.tar.gz \
+  && tar -xvf 0.29.0.gfm.13.tar.gz \
+  && cmake -S /cmark-gfm-0.29.0.gfm.13 -B /cmark-gfm-0.29.0.gfm.13/build \
+    -DCMAKE_POLICY_VERSION_MINIMUM=4.0 -DCMAKE_INSTALL_PREFIX=pkg \
+  && cmake --build /cmark-gfm-0.29.0.gfm.13/build \
+  && cmake --install /cmark-gfm-0.29.0.gfm.13/build
+
+RUN set -x \
+  && tar -czvf deps.tar.gz -C pkg .
+
+# Configure nginx & cgit + fcgiwrap
 FROM alpine:3.23.3
+COPY --from=build /deps.tar.gz /deps.tar.gz
+
+ARG DOMAIN=localhost
 
-# Install OpenSSH server and Gitolite
-# Unlock the automatically-created git user
 RUN set -x \
- && apk add --no-cache openrc fail2ban gitolite openssh
+ && apk add --no-cache \
+   curl cmark fail2ban fcgiwrap gcc gitolite libintl libressl-dev linux-headers \
+   make musl-dev musl-libintl nginx openrc openssh py3-pygments zlib-dev \
+ && tar -xvf /deps.tar.gz
 
-RUN apk update && apk update
+RUN apk update \
+ && apk upgrade --no-cache \
+ && sed -i '/getty/d' /etc/inittab
 
-RUN rc-update add fail2ban
+COPY cgit/40-fcgiwrap.sh /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh
 
-RUN git config --system advice.defaultBranchName false
+COPY cgit/cgitrc /etc/
+
+COPY cgit/nginx.conf /
+RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/http.d/default.conf \
+  && rm /nginx.conf
+
+RUN addgroup nginx www-data
+
+COPY cgit/about.html /var/www/htdocs/cgit/
+COPY cgit/cgit.png /var/www/htdocs/cgit/logo.png
+COPY cgit/favicon.ico /var/www/htdocs/cgit/
+
+COPY cgit/css_variable_colors.sh /
+COPY cgit/everforest.css /var/www/htdocs/cgit/
+RUN sh css_variable_colors.sh
+
+COPY cgit/about-formatting.sh /usr/local/lib/cgit/filters/about-formatting.sh
+RUN chmod 755 /usr/local/lib/cgit/filters/about-formatting.sh
 
 # Volume used to store SSH host keys, generated on first run
 VOLUME /etc/ssh/keys
 
+RUN rc-update add fail2ban \
+ && rc-update add fcgiwrap \
+ && rc-update add nginx \
+ && rc-update add sshd
+
+# www-data may not be necessary
+RUN addgroup fcgiwrap git
+#RUN usermod -G nginx,www-data,git nginx
+# Configure gitolite
+# Install OpenSSH server and Gitolite
+# Unlock the automatically-created git user
+
+#RUN addgroup -g 102 -S git \
+# && adduser -S -D -H -u 102 -h /var/lib/git -s /sbin/nologin -G git -g git git
+
+RUN git config --system advice.defaultBranchName false
+
 # Volume used to store all Gitolite data (keys, config and repositories), initialized on first run
 VOLUME /var/lib/git
+RUN chmod 750 /var/lib/git
+
+# Disable unwanted authentications and Disable sftp subsystem
+RUN perl -i -pe 's/^#?((?!Kerberos|GSSAPI|Password)\w*Authentication)\s.*/\1 no/;s/^(PubkeyAuthentication) no/\1 yes/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^#?(PermitRootLogin)\s.*/\1 no/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^(Subsystem\ssftp\s)/#\1/' /etc/ssh/sshd_config
+
 
 # Permissions are fixed in docker-entrypoint.sh
 RUN mkdir -p /var/lib/git/local/hooks/common
 COPY post-receive /var/lib/git/local/hooks/common/
 RUN chmod +x /var/lib/git/local/hooks/common/post-receive
 
+# Configure nginx & cgit + fcgiwrap
+#RUN addgroup -g 101 -S nginx \
+# && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx
+
 # Entrypoint responsible for SSH host keys generation, and Gitolite data initialization
 COPY docker-entrypoint.sh /
 RUN chmod +x /docker-entrypoint.sh
@@ -31,4 +113,6 @@ ENTRYPOINT ["/docker-entrypoint.sh"]
 EXPOSE 22
 
 # Default command is to run the SSH server
-CMD ["sshd"]
+#CMD ["sshd"]
+#CMD ["/sbin/init"]
+CMD ["/sbin/init"]
diff --git a/gitolite/cgit/40-fcgiwrap.sh b/gitolite/cgit/40-fcgiwrap.sh
new file mode 100644
index 0000000..3f788af
--- /dev/null
+++ b/gitolite/cgit/40-fcgiwrap.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -ex
+
+# start fastcgiwrap
+rm -f /run/fcgiwrap.socket
+nohup fcgiwrap -s unix:/run/fcgiwrap.socket &
+while ! [ -S /run/fcgiwrap.socket ]; do sleep .2; done
+chown nginx:www-data /run/fcgiwrap.socket
+#chmod g+rwx /run/fcgiwrap.socket
+#test -f nohup.out && rm -f ./nohup.out
diff --git a/gitolite/cgit/Dockerfile b/gitolite/cgit/Dockerfile
new file mode 100644
index 0000000..0c41144
--- /dev/null
+++ b/gitolite/cgit/Dockerfile
@@ -0,0 +1,50 @@
+FROM nginx:1.29.7-alpine-slim AS build
+
+RUN set -x \
+ && apk add --no-cache gcc make curl linux-headers musl-dev zlib-dev libressl-dev libintl musl-libintl
+
+RUN wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
+ && tar -xvf cgit-1.3.tar.xz
+
+WORKDIR /cgit-1.3
+RUN make get-git \
+ && DESTDIR=pkg NO_REGEX=NeedsStartEnd make install
+
+WORKDIR /cgit-1.3/pkg
+RUN tar -czvf cgit-1.3.tar.gz .
+
+
+FROM nginx:1.29.7-alpine-slim
+COPY --from=build /cgit-1.3/pkg/cgit-1.3.tar.gz /cgit-1.3.tar.gz
+
+ARG DOMAIN=localhost
+
+RUN set -x \
+ && apk add --no-cache fcgiwrap py3-pygments \
+ && tar -xvf /cgit-1.3.tar.gz
+
+RUN apk update && apk update
+
+COPY 40-fcgiwrap.sh /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh
+
+COPY cgitrc /etc/
+
+COPY nginx.conf /
+RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/conf.d/default.conf
+RUN rm /nginx.conf
+
+RUN addgroup nginx www-data
+
+COPY about.html /var/www/htdocs/cgit/
+COPY cgit.png /var/www/htdocs/cgit/logo.png
+COPY favicon.ico /var/www/htdocs/cgit/
+
+COPY css_variable_colors.sh /
+COPY everforest.css /var/www/htdocs/cgit/
+RUN sh css_variable_colors.sh
+
+#RUN sed -i -Ee 's/pid\s+.*;/pid \/tmp\/nginx.pid;/' /etc/nginx/nginx.conf
+#RUN sed -i -Ee 's/error_log\s+.*;/error_log \/dev\/stdout;/' /etc/nginx/nginx.conf
+#
+#USER nginx
diff --git a/gitolite/cgit/about-formatting.sh b/gitolite/cgit/about-formatting.sh
new file mode 100644
index 0000000..0cd0e5d
--- /dev/null
+++ b/gitolite/cgit/about-formatting.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# This may be used with the about-filter or repo.about-filter setting in cgitrc.
+# It passes formatting of about pages to differing programs, depending on the usage.
+
+# Markdown support requires python and markdown-python.
+# RestructuredText support requires python and docutils.
+# Man page support requires groff.
+
+# The following environment variables can be used to retrieve the configuration
+# of the repository for which this script is called:
+# CGIT_REPO_URL        ( = repo.url       setting )
+# CGIT_REPO_NAME       ( = repo.name      setting )
+# CGIT_REPO_PATH       ( = repo.path      setting )
+# CGIT_REPO_OWNER      ( = repo.owner     setting )
+# CGIT_REPO_DEFBRANCH  ( = repo.defbranch setting )
+# CGIT_REPO_SECTION    ( = section        setting )
+# CGIT_REPO_CLONE_URL  ( = repo.clone-url setting )
+
+cd "$(dirname $0)/html-converters/"
+case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in
+        *.markdown|*.mdown|*.md|*.mkd) cmark-gfm --to html \
+          -e footnotes \
+          -e table \
+          -e strikethrough \
+          -e autolink \
+          -e tagfilter \
+          -e tasklist \
+          --width 80 <(cat -); ;;
+        *.rst) exec ./rst2html; ;;
+        *.[1-9]) exec ./man2html; ;;
+        *.htm|*.html) exec cat; ;;
+        *.txt|*) exec ./txt2html; ;;
+esac
diff --git a/gitolite/cgit/about.html b/gitolite/cgit/about.html
new file mode 100644
index 0000000..ede0cb5
--- /dev/null
+++ b/gitolite/cgit/about.html
@@ -0,0 +1,4 @@
+<h2>Disclaimer</h2>
+I request that none of this code, in part or in full, be hosted on Github,
+Sourceforge, or any other proprietary platform. This request is made out of
+respect for both me, the developer and for you, the user.
diff --git a/gitolite/cgit/cgit.png b/gitolite/cgit/cgit.png
new file mode 100644
index 0000000..65cb7da
--- /dev/null
+++ b/gitolite/cgit/cgit.png
diff --git a/gitolite/cgit/cgitrc b/gitolite/cgit/cgitrc
new file mode 100644
index 0000000..cbfa6a9
--- /dev/null
+++ b/gitolite/cgit/cgitrc
@@ -0,0 +1,37 @@
+repository-sort=age
+clone-url=https://$HTTP_HOST$SCRIPT_NAME/$CGIT_REPO_URL
+enable-http-clone=1
+
+# Needed to avoid duplicating URI in every href
+virtual-root=/
+
+# Extra <head>
+head-include=/usr/lib/cgit/include.html
+
+# Enable us "ignoring" specific repositories
+enable-git-config=1
+
+# Self explanatory
+enable-http-clone=1
+
+# Remove .git suffix
+remove-suffix=1
+
+readme=:README.md
+about-filter=/usr/local/lib/cgit/filters/about-formatting.sh
+
+# Needs to be mountpoint of the gitolite volume
+project-list=/var/lib/git/projects.list
+scan-path=/var/lib/git/repositories
+
+# Requires python
+#source-filter=/usr/lib/cgit/filters/syntax-high.py
+
+root-title=Personal projects
+root-desc=A brief collection
+root-readme=/var/www/htdocs/cgit/about.html
+local-time=1
+
+css=/everforest.css
+css=/cgit.css
+logo=/logo.png
diff --git a/gitolite/cgit/css_variable_colors.sh b/gitolite/cgit/css_variable_colors.sh
new file mode 100644
index 0000000..fbab0cc
--- /dev/null
+++ b/gitolite/cgit/css_variable_colors.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+CGIT_CSS_PATH=/var/www/htdocs/cgit/cgit.css
+sed -i -Ee 's/\<white\>/var(--color-bg)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<blue\>/var(--color-accent)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<black\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+# Diffs?
+sed -i -Ee 's/\<green\>/var(--color-green)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#009\>/var(--color-blue)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/\<red\>/var(--color-red)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#333\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#ccc\>/var(--color-bg-2)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#000\>/var(--color-fg)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#777\>/var(--color-white)/g' "${CGIT_CSS_PATH}"
+sed -i -Ee 's/#f7f7f7\>/var(--color-bg-1)/g' "${CGIT_CSS_PATH}"
+
+sed -i -Ee 's/#eee\>/var(--color-bg-2)/g' "${CGIT_CSS_PATH}"
+
+# links
+sed -i -Ee 's/#00f\>/var(--color-accent)/g' "${CGIT_CSS_PATH}"
+
+# ago, minutes, hours
+sed -i -Ee 's/#080\>/var(--color-blue)/g' "${CGIT_CSS_PATH}"
+# ago, days
+sed -i -Ee 's/#040\>/var(--color-green)/g' "${CGIT_CSS_PATH}"
+# ago, weeks
+sed -i -Ee 's/#444\>/var(--color-yellow)/g' "${CGIT_CSS_PATH}"
+# ago, months
+sed -i -Ee 's/#888\>/var(--color-bg-yellow)/g' "${CGIT_CSS_PATH}"
+# ago, years
+sed -i -Ee 's/#bbb\>/var(--color-grey)/g' "${CGIT_CSS_PATH}"
diff --git a/gitolite/cgit/everforest.css b/gitolite/cgit/everforest.css
new file mode 100644
index 0000000..46333e3
--- /dev/null
+++ b/gitolite/cgit/everforest.css
@@ -0,0 +1,61 @@
+:root {
+  --color-bg-dim:      #1e2326;
+  --color-bg-0:        #272e33;
+  --color-bg-1:        #2e383c;
+  --color-bg-2:        #374145;
+  --color-bg-3:        #414b50;
+  --color-bg-4:        #495156;
+  --color-bg-5:        #4f5b58;
+  --color-bg-red:      #493b40;
+  --color-bg-yellow:   #45443c;
+  --color-bg-green:    #3c4841;
+  --color-bg-blue:     #384b55;
+  --color-bg-purple:   #463f48;
+  --color-bg-visual:   #4c3743;
+
+  /* Regular */
+  --color-fg:       #d3c6aa;
+  --color-red:      #e67e80;
+  --color-yellow:   #dbbc7f;
+  --color-green:    #a7c080;
+  --color-blue:     #7fbbb3;
+  --color-purple:   #d699b6;
+  --color-aqua:     #83c092;
+  --color-orange:   #e69875;
+  --color-grey-0:   #7a8478;
+  --color-grey-1:   #859289;
+  --color-grey-2:   #9da9a0;
+  --color-grey:     var(--color-grey-2);
+
+  --color-black:     var(--color-bg-dim);
+  --color-turquoise: var(--color-aqua);
+  --color-white:     var(--color-grey);
+
+
+  --color-bg:     var(--color-bg-0);
+  --color-fg-sel: var(--color-fg);
+  --color-bg-sel: var(--color-bg-visual);
+
+  --color-accent:      var(--color-green);
+  --color-header-0:    var(--color-red);
+  --color-header-1:    var(--color-orange);
+  --color-header-2:    var(--color-yellow);
+  --color-header-3:    var(--color-green);
+  --color-header-4:    var(--color-blue);
+  --color-header-5:    var(--color-purple);
+  --color-header-delim:var(--color-grey-1);
+
+  --color-list-point-0:    var(--color-red);
+  --color-list-point-1:    var(--color-orange);
+  --color-list-point-2:    var(--color-yellow);
+  --color-list-point-3:    var(--color-green);
+  --color-list-point-4:    var(--color-blue);
+  --color-list-point-5:    var(--color-purple);
+
+  --color-var(--color-blue):
+}
+
+body {
+  background-color: var(--color-bg);
+  color: var(--color-fg);
+}
diff --git a/gitolite/cgit/favicon.ico b/gitolite/cgit/favicon.ico
new file mode 100644
index 0000000..f4d51ba
--- /dev/null
+++ b/gitolite/cgit/favicon.ico
diff --git a/gitolite/cgit/favicon.png b/gitolite/cgit/favicon.png
new file mode 100644
index 0000000..da6269e
--- /dev/null
+++ b/gitolite/cgit/favicon.png
diff --git a/gitolite/cgit/nginx.conf b/gitolite/cgit/nginx.conf
new file mode 100644
index 0000000..f4a115b
--- /dev/null
+++ b/gitolite/cgit/nginx.conf
@@ -0,0 +1,22 @@
+server {
+    server_name $DOMAIN;
+
+    listen [::]:80;
+    listen 80;
+
+    access_log  /var/log/nginx/cgit-access.log;
+    error_log   /var/log/nginx/cgit-error.log;
+
+    root /var/www/htdocs/cgit;
+    try_files $uri @cgit;
+
+    location @cgit {
+        include          fastcgi_params;
+        fastcgi_param    SCRIPT_FILENAME /var/www/htdocs/cgit/cgit.cgi;
+        fastcgi_pass     unix:/run/fcgiwrap/fcgiwrap.sock;
+
+        fastcgi_param    PATH_INFO    $uri;
+        fastcgi_param    QUERY_STRING $args;
+        fastcgi_param    HTTP_HOST    $server_name;
+    }
+}
diff --git a/gitolite/docker-entrypoint.sh b/gitolite/docker-entrypoint.sh
index 3d08d34..d83d9e0 100644
--- a/gitolite/docker-entrypoint.sh
+++ b/gitolite/docker-entrypoint.sh
@@ -42,8 +42,18 @@ else
   su - git -c "gitolite setup"
 fi
 
+su - git -c "chmod 750 ~git/repositories"
+su - git -c "chmod 640 ~git/projects.list"
+
 if [ "${1}" != 'sshd' ]; then
-  sed -i -Ee "s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'cgit.*',/" /var/lib/git/.gitolite.rc
+ #         LOCAL_CODE                =>  "$ENV{HOME}/local",
+
+    su - git -c "sed -i -Ee \"s/^([^#]*UMASK\\s*=>\\s*)[0-9]*\\s*,/\\1 0027,/\" /var/lib/git/.gitolite.rc"
+    su - git -c "sed -i -Ee \"s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'.*',/\" /var/lib/git/.gitolite.rc"
+    #su - git -c "sed -i -Ee 's/#?(\\s*LOCAL_CODE\\s+=>\\s+\"\\\$ENV\\{HOME\\}\\/local\",.*)/\\1/' ~/.gitolite.rc"
+    #su - git -c "chmod 650 ~git/repositories"
+    #su - git -c "chmod 640 ~git/projects.list"
+  #sed -i -Ee "s/^([^#]*UMASK\\s*=>)\\s*'[^']*'\\s*,/\\1 0027,/" /var/lib/git/.gitolite.rc
   #sed -i -Ee "s/^([^#]*GIT_CONFIG_KEYS\\s*=>\\s*)'[^']*'\\s*,/\\1'.*',/" /var/lib/git/.gitolite.rc
 fi