[OCaml] Mobile-friendly clone of cgit.
docs update defaults and documentation for /srv/git architecture
- Default git_project_root is now /srv/git (no longer $HOME/git) - Deploy service uses Group=git for repo read access - README documents the recommended ownership model (git:git), SSH push setup, and systemd deployment
Changed files
README.org
@@ -47,9 +47,38 @@
47
47
missing file uses environment-derived defaults; malformed or invalid
48
48
files never silently fall back.
49
49
50
Removed:
The =commits_max_displayed= value controls commit list lengths on summary,
51
Removed:
all-commit, and branch pages. =default_branch= is tried after =HEAD= and
50
Added:
See =config.toml= at the project root for a reference of all available
51
Added:
variables with their defaults and documentation.
52
Added:
53
Added:
The =commits_max_displayed= value controls commit list lengths on
54
Added:
all-commit and branch pages. =default_branch= is tried after =HEAD= and
52
55
before the conventional =main= and =master= fallbacks.
56
Added:
57
Added:
58
Added:
* Deployment
59
Added:
60
Added:
** Repository layout
61
Added:
62
Added:
Git repositories are expected under =/srv/git= (the default
63
Added:
=git_project_root=), owned by a dedicated =git= user:
64
Added:
65
Added:
#+begin_example
66
Added:
/srv/git/ git:git 750
67
Added:
/srv/git/repo.git/ git:git 750
68
Added:
#+end_example
69
Added:
70
Added:
The ogit service runs as a separate user (e.g. =ogit=) with group =git=
71
Added:
for read access. This allows =ProtectHome=yes= in systemd hardening.
72
Added:
73
Added:
** SSH push access
74
Added:
75
Added:
Push access uses the =git= user over SSH. Place authorized public keys
76
Added:
in =/srv/git/.ssh/authorized_keys=. Set the =git= user's shell to
77
Added:
=/usr/bin/git-shell= to restrict interactive login.
78
Added:
79
Added:
** systemd
80
Added:
81
Added:
A sample unit file is provided in =deploy/ogit.service=.
53
82
54
83
55
84
* Alternatives
deploy/ogit.service
@@ -10,7 +10,7 @@
10
10
RestartSec=5
11
11
12
12
User=ogit
13
Removed:
Group=ogit
13
Added:
Group=git
14
14
15
15
# Hardening
16
16
NoNewPrivileges=yes
lib/config.ml
@@ -24,11 +24,10 @@
24
24
match Sys.getenv_opt name with Some "" | None -> None | value -> value
25
25
26
26
let default =
27
Removed:
let home = environment_value "HOME" |> Option.value ~default:"." in
28
27
{
29
28
user_name = "";
30
29
default_branch = "main";
31
Removed:
git_project_root = Filename.concat home "git";
30
Added:
git_project_root = "/srv/git";
32
31
commits_max_displayed = 10;
33
32
title = "";
34
33
host = "127.0.0.1";