diff options
| -rw-r--r-- | ops/machines/whitby/default.nix | 6 | ||||
| -rw-r--r-- | ops/modules/cgit.nix | 22 |
2 files changed, 24 insertions, 4 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix index ea9f25accba8..940cfc910a24 100644 --- a/ops/machines/whitby/default.nix +++ b/ops/machines/whitby/default.nix @@ -413,7 +413,11 @@ in nixery.enable = true; # Run cgit & josh to serve git - cgit.enable = true; + cgit = { + enable = true; + user = "git"; # run as the same user as gerrit + }; + josh.enable = true; # Configure backups to GleSYS diff --git a/ops/modules/cgit.nix b/ops/modules/cgit.nix index 25318d1d723e..fc3f17158579 100644 --- a/ops/modules/cgit.nix +++ b/ops/modules/cgit.nix @@ -3,6 +3,14 @@ let cfg = config.services.depot.cgit; + + userConfig = + if builtins.isNull cfg.user then { + DynamicUser = true; + } else { + User = cfg.user; + Group = cfg.user; + }; in { options.services.depot.cgit = with lib; { @@ -19,6 +27,16 @@ in type = types.str; default = "/var/lib/gerrit/git/depot.git/"; }; + + user = mkOption { + description = '' + User to use for the cgit service. It is expected that this is + also the name of the user's primary group. + ''; + + type = with types; nullOr str; + default = null; + }; }; config = lib.mkIf cfg.enable { @@ -27,13 +45,11 @@ in serviceConfig = { Restart = "on-failure"; - User = "git"; - Group = "git"; ExecStart = depot.web.cgit-tvl.override { inherit (cfg) port repo; }; - }; + } // userConfig; }; }; } |