diff options
author | Vincent Ambo <mail@tazj.in> | 2022-07-11T11·15+0000 |
---|---|---|
committer | tazjin <tazjin@tvl.su> | 2022-07-12T08·49+0000 |
commit | fcfd097e658a2c44bb1a6950d04ecd4c508b3c0f (patch) | |
tree | f98d42a3de5917b7a1aa806c962a1b9d73b23042 | |
parent | 39d589b84b6c84cddbb4ea0ac97486cdc4e2b187 (diff) |
refactor(ops/cgit): make user configurable r/4295
on whitby, cgit runs as the gerrit user to get access to serving gerrit's repositories directly. on other machines (e.g. sanduny) this isn't necessary, as we have a world-readable depot replica. Change-Id: Ibf7e7cc08e5909e0fa182e561ab0cb472188edcb Reviewed-on: https://cl.tvl.fyi/c/depot/+/5932 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
Diffstat (limited to '')
-rw-r--r-- | ops/machines/whitby/default.nix | 6 | ||||
-rw-r--r-- | ops/modules/cgit.nix | 22 |
2 files changed, 24 insertions, 4 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix index ea9f25accba8..940cfc910a24 100644 --- a/ops/machines/whitby/default.nix +++ b/ops/machines/whitby/default.nix @@ -413,7 +413,11 @@ in nixery.enable = true; # Run cgit & josh to serve git - cgit.enable = true; + cgit = { + enable = true; + user = "git"; # run as the same user as gerrit + }; + josh.enable = true; # Configure backups to GleSYS diff --git a/ops/modules/cgit.nix b/ops/modules/cgit.nix index 25318d1d723e..fc3f17158579 100644 --- a/ops/modules/cgit.nix +++ b/ops/modules/cgit.nix @@ -3,6 +3,14 @@ let cfg = config.services.depot.cgit; + + userConfig = + if builtins.isNull cfg.user then { + DynamicUser = true; + } else { + User = cfg.user; + Group = cfg.user; + }; in { options.services.depot.cgit = with lib; { @@ -19,6 +27,16 @@ in type = types.str; default = "/var/lib/gerrit/git/depot.git/"; }; + + user = mkOption { + description = '' + User to use for the cgit service. It is expected that this is + also the name of the user's primary group. + ''; + + type = with types; nullOr str; + default = null; + }; }; config = lib.mkIf cfg.enable { @@ -27,13 +45,11 @@ in serviceConfig = { Restart = "on-failure"; - User = "git"; - Group = "git"; ExecStart = depot.web.cgit-tvl.override { inherit (cfg) port repo; }; - }; + } // userConfig; }; }; } |