Eerste commit met werkende opzet

diff --git a/.gitignore b/.gitignore
new file mode 100644 (file)
index 0000000..15780fe
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+gitd/authorized_keys
\ No newline at end of file

diff --git a/Caddyfile b/Caddyfile
new file mode 100644 (file)
index 0000000..a537ee4
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,23 @@
+git.okketaaien.nl {
+    encode zstd gzip
+
+    handle /static/* {
+        root * /usr/share/gitweb
+        file_server
+    }
+
+    handle {
+        rewrite * /gitweb.cgi
+
+        reverse_proxy gitweb:9000 {
+        transport fastcgi {
+            split .cgi
+            env SCRIPT_FILENAME /usr/share/gitweb/gitweb.cgi
+            }
+        }    
+    }
+
+    log {
+        output file /var/log/caddy/gitweb.log
+    }
+}

diff --git a/Containerfile.gitd b/Containerfile.gitd
new file mode 100644 (file)
index 0000000..70c074f
--- /dev/null
+++ b/Containerfile.gitd
@@ -0,0 +1,25 @@
+FROM docker.io/library/debian:13-slim
+
+# Packages
+RUN apt-get update && \
+    apt-get --yes --no-install-recommends install openssh-server git && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --system gitd && \
+    useradd --system \
+        --gid gitd \
+        --home-dir /srv/git \
+        --create-home \
+        --shell /usr/bin/git-shell \
+        git && \
+    mkdir -p /srv/git/.ssh /run/sshd && \
+    chmod 700 /srv/git/.ssh && \
+    touch /srv/git/.ssh/authorized_keys && \
+    chmod 600 /srv/git/.ssh/authorized_keys && \
+    chown -R git:gitd /srv/git
+
+COPY ./gitd/sshd_config /etc/ssh/sshd_config
+
+EXPOSE 2222
+
+CMD ["/usr/sbin/sshd", "-D", "-e"]
\ No newline at end of file

diff --git a/Containerfile.gitweb b/Containerfile.gitweb
new file mode 100644 (file)
index 0000000..7de0d4a
--- /dev/null
+++ b/Containerfile.gitweb
@@ -0,0 +1,36 @@
+FROM docker.io/library/debian:13-slim
+
+# Packages
+RUN apt-get update && \
+    apt-get --yes --no-install-recommends install \
+    gitweb highlight libcgi-fast-perl fcgiwrap spawn-fcgi && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --system gitweb && \
+    useradd --system \
+        --gid gitweb \
+        --home-dir /none \
+        --no-create-home \
+        --shell /usr/sbin/nologin \
+        gitweb
+
+# Instellingen goed zetten in /etc/gitweb.conf
+RUN cat > /etc/gitweb.conf <<'EOF'
+our $projectroot = "/srv/gitweb-repos";
+
+our $home_link = "/";
+
+$feature{'blame'}{'default'} = [1];
+$feature{'highlight'}{'default'} = [1];
+
+$prevent_xss = 1;
+EOF
+
+RUN mkdir -p /run/gitweb && \
+    chown gitweb:gitweb /run/gitweb
+
+WORKDIR /usr/share/gitweb
+
+USER gitweb
+
+CMD ["/usr/bin/spawn-fcgi", "-n", "-a", "0.0.0.0", "-p", "9000", "--", "/usr/sbin/fcgiwrap"]

diff --git a/gitd/sshd_config b/gitd/sshd_config
new file mode 100644 (file)
index 0000000..399466e
--- /dev/null
+++ b/gitd/sshd_config
@@ -0,0 +1,25 @@
+Port 2222
+ListenAddress 0.0.0.0
+
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+PubkeyAuthentication yes
+
+AllowUsers git
+
+# Alleen git-operaties toestaan (git-shell staat interactieve commando's al niet toe)
+# ForceCommand als extra zekerheid:
+ForceCommand /usr/bin/git-shell -c "$SSH_ORIGINAL_COMMAND"
+
+PrintMotd no
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+PermitTunnel no
+
+UsePAM no
+StrictModes yes
+ClientAliveInterval 120
+ClientAliveCountMax 3
\ No newline at end of file

diff --git a/podman-compose.yaml b/podman-compose.yaml
new file mode 100644 (file)
index 0000000..23d2822
--- /dev/null
+++ b/podman-compose.yaml
@@ -0,0 +1,72 @@
+services:
+  gitd:
+    build:
+      context: .
+      dockerfile: ./Containerfile.gitd
+    ports:
+      - "2222:2222"
+    volumes:
+      - /srv/gitweb/repos:/srv/git/repos:Z
+      - ./gitd/sshd_config:/etc/ssh/sshd_config:ro,Z
+      - ./gitd/authorized_keys:/srv/git/.ssh/authorized_keys:ro,Z
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETUID
+      - SETGID
+      - SYS_CHROOT
+      - AUDIT_WRITE
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    networks:
+      - gitd
+
+  gitweb:
+    build:
+      context: .
+      dockerfile: ./Containerfile.gitweb
+    volumes:
+      - /srv/gitweb/repos:/srv/gitweb-repos:ro
+      - gitweb_run:/run/gitweb:U,Z
+      - gitweb_www:/usr/share/gitweb:ro
+    read_only: true
+    expose:
+      - "9000"
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    networks:
+      - gitweb
+
+  caddy:
+    image: docker.io/library/caddy
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro,Z
+      - caddy_data:/data:Z
+      - caddy_config:/config:Z
+      - ./logs/caddy:/var/log/caddy:Z
+      - gitweb_run:/run/gitweb:ro
+      - gitweb_www:/usr/share/gitweb:ro
+    restart: unless-stopped
+    depends_on:
+      - gitweb
+    networks:
+      - gitweb
+
+volumes:
+  caddy_data:
+  caddy_config:
+  gitweb_run:
+  gitweb_www:
+
+networks:
+  gitd:
+  gitweb: