[OCaml] Mobile-friendly clone of cgit.
Add deployment configuration and documentation
- deploy/config.toml: example production configuration - deploy/ogit.service: systemd unit with hardening directives - deploy/README.md: step-by-step deployment instructions
Changed files
deploy/README.md
@@ -0,0 +1,71 @@
1
Added:
# Deploying ogit
2
Added:
3
Added:
## Prerequisites
4
Added:
5
Added:
- Debian 11 (or similar) x86_64 VPS
6
Added:
- Nginx configured as a reverse proxy (not covered here)
7
Added:
- Bare git repositories under a common root (e.g. `/srv/git`)
8
Added:
9
Added:
## Steps
10
Added:
11
Added:
### 1. Create the service user
12
Added:
13
Added:
```sh
14
Added:
useradd --system --shell /usr/sbin/nologin --home-dir /nonexistent ogit
15
Added:
```
16
Added:
17
Added:
Ensure the `ogit` user can read your git repositories:
18
Added:
19
Added:
```sh
20
Added:
usermod -aG git ogit # if repos are group-readable by 'git'
21
Added:
```
22
Added:
23
Added:
### 2. Install the binary
24
Added:
25
Added:
```sh
26
Added:
cp dist/ogit /usr/local/bin/ogit
27
Added:
chmod 755 /usr/local/bin/ogit
28
Added:
```
29
Added:
30
Added:
### 3. Install the configuration
31
Added:
32
Added:
```sh
33
Added:
mkdir -p /etc/ogit
34
Added:
cp deploy/config.toml /etc/ogit/config.toml
35
Added:
```
36
Added:
37
Added:
Edit `/etc/ogit/config.toml` to match your environment:
38
Added:
39
Added:
- `user` — displayed in the footer copyright
40
Added:
- `git_project_root` — path to the directory containing your bare repos
41
Added:
- `host` — bind address (keep `127.0.0.1` when behind Nginx)
42
Added:
- `port` — port Nginx will proxy to
43
Added:
44
Added:
### 4. Install and start the service
45
Added:
46
Added:
```sh
47
Added:
cp deploy/ogit.service /etc/systemd/system/ogit.service
48
Added:
systemctl daemon-reload
49
Added:
systemctl enable --now ogit
50
Added:
```
51
Added:
52
Added:
### 5. Verify
53
Added:
54
Added:
```sh
55
Added:
curl http://127.0.0.1:8081/
56
Added:
systemctl status ogit
57
Added:
```
58
Added:
59
Added:
## Updating
60
Added:
61
Added:
```sh
62
Added:
systemctl stop ogit
63
Added:
cp dist/ogit /usr/local/bin/ogit
64
Added:
systemctl start ogit
65
Added:
```
66
Added:
67
Added:
## Logs
68
Added:
69
Added:
```sh
70
Added:
journalctl -u ogit -f
71
Added:
```
deploy/config.toml
@@ -0,0 +1,9 @@
1
Added:
# ogit configuration
2
Added:
# Place at /etc/ogit/config.toml (or set OGIT_CONFIG to override)
3
Added:
4
Added:
user = "git"
5
Added:
default_branch = "main"
6
Added:
git_project_root = "/srv/git"
7
Added:
commits_max_displayed = 10
8
Added:
host = "127.0.0.1"
9
Added:
port = 8081
deploy/ogit.service
@@ -0,0 +1,28 @@
1
Added:
[Unit]
2
Added:
Description=ogit - mobile-friendly git web interface
3
Added:
After=network.target
4
Added:
5
Added:
[Service]
6
Added:
Type=simple
7
Added:
ExecStart=/usr/local/bin/ogit
8
Added:
Environment=OGIT_CONFIG=/etc/ogit/config.toml
9
Added:
Restart=on-failure
10
Added:
RestartSec=5
11
Added:
12
Added:
User=ogit
13
Added:
Group=ogit
14
Added:
15
Added:
# Hardening
16
Added:
NoNewPrivileges=yes
17
Added:
ProtectSystem=strict
18
Added:
ProtectHome=yes
19
Added:
ReadOnlyPaths=/srv/git
20
Added:
PrivateTmp=yes
21
Added:
PrivateDevices=yes
22
Added:
ProtectKernelTunables=yes
23
Added:
ProtectControlGroups=yes
24
Added:
RestrictSUIDSGID=yes
25
Added:
RestrictNamespaces=yes
26
Added:
27
Added:
[Install]
28
Added:
WantedBy=multi-user.target