git browser and HTTP backend: harden config and port to Debian 10.

8 files changed, 160 insertions, 61 deletions

diff --git a/roles/git/files/etc/nginx/sites-available/git b/roles/git/files/etc/nginx/sites-available/git
index 73ac1e6..7ad765f 100644
--- a/roles/git/files/etc/nginx/sites-available/git
+++ b/roles/git/files/etc/nginx/sites-available/git
@@ -4,7 +4,7 @@ server {
 
     server_name  git.fripost.org;
 
-    include snippets/acme-challenge.conf;
+    include /etc/lacme/nginx.conf;
 
     access_log /var/log/nginx/git.access.log;
     error_log  /var/log/nginx/git.error.log info;
@@ -25,6 +25,8 @@ server {
     error_log  /var/log/nginx/git.error.log info;
 
     include snippets/headers.conf;
+    add_header Content-Security-Policy
+               "default-src 'none'; img-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self'";
 
     include snippets/ssl.conf;
     ssl_certificate     ssl/git.fripost.org.pem;
@@ -36,33 +38,35 @@ server {
         expires 30d;
     }
 
-    # Bypass the CGI to return static files stored on disk. Try first repo with
-    # a trailing '.git', then without.
-    location ~* "^/((?U)[^/]+)(?:\.git)?/objects/(?:[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(?:pack|idx))$" {
-        root /var/lib/gitolite/repositories;
-        try_files /$1.git/objects/$2 /$1/objects/$2 =404;
-        expires 30d;
-        gzip off;
-        # TODO honor git-daemon-export-ok
-    }
-
     # disallow push over HTTP/HTTPS
-    location ~* "^/[^/]+/git-receive-pack$" { return 403; }
+    location ~ "^/.+/git-receive-pack$" { return 403; }
 
-    location ~* "^/[^/]+/(?:HEAD|info/refs|objects/info/[^/]+|git-upload-pack)$" {
+    location ~ "^/.+/(?:info/refs|git-upload-pack)$" {
+        limit_except GET POST { deny all; }
+        fastcgi_buffering off;
         gzip off;
-        include uwsgi_params;
-        uwsgi_modifier1 9;
-        uwsgi_param GIT_PROJECT_ROOT /var/lib/gitolite/repositories;
-        uwsgi_pass unix:/run/uwsgi/app/git-http-backend/socket;
+
+        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        fastcgi_param NO_BUFFERING    "";
+
+        # cf. git-http-backend(1)
+        fastcgi_param GIT_PROJECT_ROOT /var/lib/gitolite/repositories;
+        fastcgi_param PATH_INFO        $uri;
+        fastcgi_param CONTENT_TYPE     $content_type;
+        fastcgi_param QUERY_STRING     $query_string;
+        fastcgi_param REQUEST_METHOD   $request_method;
+        fastcgi_pass unix:/run/git-http-backend.socket;
     }
 
 
     # send all other URLs to cgit
     location / {
         gzip off;
-        include uwsgi_params;
-        uwsgi_modifier1 9;
-        uwsgi_pass unix:/run/uwsgi/app/cgit/socket;
+        fastcgi_param SCRIPT_FILENAME  /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO        $uri;
+        fastcgi_param CONTENT_TYPE     $content_type;
+        fastcgi_param QUERY_STRING     $query_string;
+        fastcgi_param REQUEST_METHOD   $request_method;
+        fastcgi_pass unix:/run/cgit.socket;
     }
 }
diff --git a/roles/git/files/etc/systemd/system/cgit.service b/roles/git/files/etc/systemd/system/cgit.service
new file mode 100644
index 0000000..08037ac
--- /dev/null
+++ b/roles/git/files/etc/systemd/system/cgit.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=hyperfast web frontend for git repositories written in C
+Documentation=https://git.zx2c4.com/cgit/
+
+[Service]
+User=_cgit
+Group=nogroup
+SupplementaryGroups=gitolite
+ExecStart=/usr/sbin/fcgiwrap
+SyslogIdentifier=cgit
+#
+# Hardening
+NoNewPrivileges=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ReadWriteDirectories=/var/cache/cgit
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/git/files/etc/systemd/system/cgit.socket b/roles/git/files/etc/systemd/system/cgit.socket
new file mode 100644
index 0000000..bba4bef
--- /dev/null
+++ b/roles/git/files/etc/systemd/system/cgit.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=hyperfast web frontend for git repositories written in C
+Documentation=https://git.zx2c4.com/cgit/
+
+[Socket]
+ListenStream=%t/cgit.socket
+SocketUser=www-data
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target
diff --git a/roles/git/files/etc/systemd/system/git-http-backend.service b/roles/git/files/etc/systemd/system/git-http-backend.service
new file mode 100644
index 0000000..f973370
--- /dev/null
+++ b/roles/git/files/etc/systemd/system/git-http-backend.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Git HTTP backend
+Documentation=man:git-http-backend(1)
+
+[Service]
+DynamicUser=yes
+SupplementaryGroups=gitolite
+ExecStart=/usr/sbin/fcgiwrap
+SyslogIdentifier=git-http-backend
+#
+# Hardening
+NoNewPrivileges=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/git/files/etc/systemd/system/git-http-backend.socket b/roles/git/files/etc/systemd/system/git-http-backend.socket
new file mode 100644
index 0000000..c2820d4
--- /dev/null
+++ b/roles/git/files/etc/systemd/system/git-http-backend.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Git HTTP backend
+Documentation=man:git-http-backend(1)
+
+[Socket]
+ListenStream=%t/git-http-backend.socket
+SocketUser=www-data
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target
diff --git a/roles/git/handlers/main.yml b/roles/git/handlers/main.yml
index d52c9cc..6212d91 100644
--- a/roles/git/handlers/main.yml
+++ b/roles/git/handlers/main.yml
@@ -2,8 +2,17 @@
 - name: systemctl daemon-reload
   command: /bin/systemctl daemon-reload
 
-- name: Restart uWSGI
-  service: name=uwsgi state=restarted
+- name: Stop cgit
+  service: name=cgit.service state=stopped
+
+- name: Restart cgit
+  service: name=cgit.socket state=restarted
+
+- name: Stop git-http-backend
+  service: name=git-http-backend.service state=stopped
+
+- name: Restart git-http-backend
+  service: name=git-http-backend.socket state=restarted
 
 - name: Restart Nginx
   service: name=nginx state=restarted
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index 160ede6..120f204 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -4,79 +4,99 @@
     packages:
     - cgit
     - highlight
-    - uwsgi
+    - fcgiwrap
+
+- name: Stop and disable fcgiwrap socket
+  service: name=fcgiwrap.socket state=stopped enabled=false
+
+- name: Stop fcgiwrap service
+  service: name=fcgiwrap.service state=stopped
 
 - name: Configure cgit
   copy: src=etc/cgitrc
         dest=/etc/cgitrc
         owner=root group=root
         mode=0644
-  register: r1
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
 - name: Copy /usr/lib/cgit/filters/syntax-highlighting2.sh
   copy: src=usr/lib/cgit/filters/syntax-highlighting2.sh
         dest=/usr/lib/cgit/filters/syntax-highlighting2.sh
         owner=root group=root
         mode=0755
-  register: r2
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
-- name: Create a user 'cgit'
-  user: name=cgit system=yes
-        home=/var/www
+- name: Create '_cgit' user
+  user: name=_cgit system=yes
+        group=nogroup
+        home=/nonexistent
         shell=/usr/sbin/nologin
         password=!
         state=present
-  register: r3
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
+# Make it sticky: `dpkg-statoverride --add _cgit nogroup 0700 /var/cache/cgit`
 - name: Create cache directory /var/cache/cgit
   file: path=/var/cache/cgit
         state=directory
-        owner=cgit group=cgit
+        owner=_cgit group=nogroup
         mode=0700
 
-- name: Create /etc/uwsgi/apps-available/{cgit,git-http-backend}.ini
-  copy: src=etc/uwsgi/apps-available/{{ item }}.ini
-        dest=/etc/uwsgi/apps-available/{{ item }}.ini
+- name: Copy cgit service unit
+  copy: src=etc/systemd/system/cgit.service
+        dest=/etc/systemd/system/cgit.service
         owner=root group=root
         mode=0644
-  register: r4
-  with_items:
-    - cgit
-    - git-http-backend
   notify:
-    - Restart uWSGI
+    - systemctl daemon-reload
+    - Stop cgit
 
-- name: Create /etc/uwsgi/apps-enabled/{cgit,git-http-backend}.ini
-  file: src=../apps-available/{{ item }}.ini
-        dest=/etc/uwsgi/apps-enabled/{{ item }}.ini
+- name: Copy cgit socket unit
+  copy: src=etc/systemd/system/cgit.socket
+        dest=/etc/systemd/system/cgit.socket
         owner=root group=root
-        state=link force=yes
-  register: r5
-  with_items:
-    - cgit
-    - git-http-backend
+        mode=0644
   notify:
-    - Restart uWSGI
+    - systemctl daemon-reload
+    - Restart cgit
 
-- name: Start uWSGI
-  service: name=nginx state=started
-  when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed)
+- name: Disable cgit service
+  service: name=cgit.service enabled=false
+
+- name: Start cgit socket
+  service: name=cgit.socket state=started enabled=true
 
 - meta: flush_handlers
 
-- name: Add 'cgit' & 'www-data' to the group 'gitolite'
-  user: name={{ item }} groups=gitolite append=yes
-  with_items:
-    # for the cgit interface
-    - cgit
-    # for pulls over HTTP/HTTPS
-    - www-data
+
+- name: Copy git-http-backend service unit
+  copy: src=etc/systemd/system/git-http-backend.service
+        dest=/etc/systemd/system/git-http-backend.service
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Stop git-http-backend
+
+- name: Copy git-http-backend socket unit
+  copy: src=etc/systemd/system/git-http-backend.socket
+        dest=/etc/systemd/system/git-http-backend.socket
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Restart git-http-backend
+
+- name: Disable git-http-backend service
+  service: name=git-http-backend.service enabled=false
+
+- name: Start git-http-backend socket
+  service: name=git-http-backend.socket state=started enabled=true
+
+- meta: flush_handlers
 
 
 - name: Copy /etc/nginx/sites-available/git
diff --git a/roles/git/tasks/gitolite.yml b/roles/git/tasks/gitolite.yml
index 38000a7..e7d1fe3 100644
--- a/roles/git/tasks/gitolite.yml
+++ b/roles/git/tasks/gitolite.yml
@@ -31,6 +31,6 @@
               owner=root group=root
               mode=0644
   with_items:
-    # See /usr/share/doc/gitolite3/README.txt.gz
+    # See /usr/share/doc/gitolite3/README.markdown.gz
     - { var: UMASK,           value: "0027"                            }
     - { var: GIT_CONFIG_KEYS, value: "'gitweb\\..* gc\\..* hook\\..*'" }