From 70f16ac939497e3e424bad05c5f82ce36d1bceda Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sat, 16 May 2020 20:33:52 +0200
Subject: git browser and HTTP backend: harden config and port to Debian 10.

---
 roles/git/tasks/cgit.yml     | 96 ++++++++++++++++++++++++++------------------
 roles/git/tasks/gitolite.yml |  2 +-
 2 files changed, 59 insertions(+), 39 deletions(-)

(limited to 'roles/git/tasks')

diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index 160ede6..120f204 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -4,79 +4,99 @@
     packages:
     - cgit
     - highlight
-    - uwsgi
+    - fcgiwrap
+
+- name: Stop and disable fcgiwrap socket
+  service: name=fcgiwrap.socket state=stopped enabled=false
+
+- name: Stop fcgiwrap service
+  service: name=fcgiwrap.service state=stopped
 
 - name: Configure cgit
   copy: src=etc/cgitrc
         dest=/etc/cgitrc
         owner=root group=root
         mode=0644
-  register: r1
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
 - name: Copy /usr/lib/cgit/filters/syntax-highlighting2.sh
   copy: src=usr/lib/cgit/filters/syntax-highlighting2.sh
         dest=/usr/lib/cgit/filters/syntax-highlighting2.sh
         owner=root group=root
         mode=0755
-  register: r2
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
-- name: Create a user 'cgit'
-  user: name=cgit system=yes
-        home=/var/www
+- name: Create '_cgit' user
+  user: name=_cgit system=yes
+        group=nogroup
+        home=/nonexistent
         shell=/usr/sbin/nologin
         password=!
         state=present
-  register: r3
   notify:
-    - Restart uWSGI
+    - Stop cgit
 
+# Make it sticky: `dpkg-statoverride --add _cgit nogroup 0700 /var/cache/cgit`
 - name: Create cache directory /var/cache/cgit
   file: path=/var/cache/cgit
         state=directory
-        owner=cgit group=cgit
+        owner=_cgit group=nogroup
         mode=0700
 
-- name: Create /etc/uwsgi/apps-available/{cgit,git-http-backend}.ini
-  copy: src=etc/uwsgi/apps-available/{{ item }}.ini
-        dest=/etc/uwsgi/apps-available/{{ item }}.ini
+- name: Copy cgit service unit
+  copy: src=etc/systemd/system/cgit.service
+        dest=/etc/systemd/system/cgit.service
         owner=root group=root
         mode=0644
-  register: r4
-  with_items:
-    - cgit
-    - git-http-backend
   notify:
-    - Restart uWSGI
+    - systemctl daemon-reload
+    - Stop cgit
 
-- name: Create /etc/uwsgi/apps-enabled/{cgit,git-http-backend}.ini
-  file: src=../apps-available/{{ item }}.ini
-        dest=/etc/uwsgi/apps-enabled/{{ item }}.ini
+- name: Copy cgit socket unit
+  copy: src=etc/systemd/system/cgit.socket
+        dest=/etc/systemd/system/cgit.socket
         owner=root group=root
-        state=link force=yes
-  register: r5
-  with_items:
-    - cgit
-    - git-http-backend
+        mode=0644
   notify:
-    - Restart uWSGI
+    - systemctl daemon-reload
+    - Restart cgit
 
-- name: Start uWSGI
-  service: name=nginx state=started
-  when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed)
+- name: Disable cgit service
+  service: name=cgit.service enabled=false
+
+- name: Start cgit socket
+  service: name=cgit.socket state=started enabled=true
 
 - meta: flush_handlers
 
-- name: Add 'cgit' & 'www-data' to the group 'gitolite'
-  user: name={{ item }} groups=gitolite append=yes
-  with_items:
-    # for the cgit interface
-    - cgit
-    # for pulls over HTTP/HTTPS
-    - www-data
+
+- name: Copy git-http-backend service unit
+  copy: src=etc/systemd/system/git-http-backend.service
+        dest=/etc/systemd/system/git-http-backend.service
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Stop git-http-backend
+
+- name: Copy git-http-backend socket unit
+  copy: src=etc/systemd/system/git-http-backend.socket
+        dest=/etc/systemd/system/git-http-backend.socket
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Restart git-http-backend
+
+- name: Disable git-http-backend service
+  service: name=git-http-backend.service enabled=false
+
+- name: Start git-http-backend socket
+  service: name=git-http-backend.socket state=started enabled=true
+
+- meta: flush_handlers
 
 
 - name: Copy /etc/nginx/sites-available/git
diff --git a/roles/git/tasks/gitolite.yml b/roles/git/tasks/gitolite.yml
index 38000a7..e7d1fe3 100644
--- a/roles/git/tasks/gitolite.yml
+++ b/roles/git/tasks/gitolite.yml
@@ -31,6 +31,6 @@
               owner=root group=root
               mode=0644
   with_items:
-    # See /usr/share/doc/gitolite3/README.txt.gz
+    # See /usr/share/doc/gitolite3/README.markdown.gz
     - { var: UMASK,           value: "0027"                            }
     - { var: GIT_CONFIG_KEYS, value: "'gitweb\\..* gc\\..* hook\\..*'" }
-- 
cgit v1.2.3