[bug#72400] services: gitile: Allow to set user and group.
Commit Message
Comments
Hi, does the default gitile user work for you out of the box?
I'm asking as I'm speculating you have the git user own the
repositories.
I sent out https://issues.guix.gnu.org/71143#1 a while ago to fix it.
Hello! It does not work, and that is the reason for this patch.
At this point group access is not enough, I have to run gitile from
git user (of gitolite) who owns repositories. Same for fcgiwrap.
This problem is related to the change in libgit2, and for a long time
I just kept it downgraded, but this cannot be forever.
I also tried to play with safe-directory option without any success,
but even if it worked setting config for every service that works with
git seems like a huge overhead.
Changing default user to git may be quite radical, but since the
documentation states this:
> Gitile works best in collaboration with Gitolite, and will serve the
> public repositories from Gitolite by default.
I think it is sane.
On 2024-08-01 at 11:45+03:00, Evgeny Pisemsky wrote:
> Hello! It does not work, and that is the reason for this patch.
>
> At this point group access is not enough, I have to run gitile from
> git user (of gitolite) who owns repositories. Same for fcgiwrap.
>
> Changing default user to git may be quite radical, but since the
> documentation states this:
>
> > Gitile works best in collaboration with Gitolite, and will serve the
> > public repositories from Gitolite by default.
>
> I think it is sane.
Seconded, and IMHO the Guix service documentation should mention
that the default user for gitile is to match the owner
of the repositories:
On 2024-07-31 at 18:00+03:00, Evgeny Pisemsky wrote:
+@item @code{user} (default: @code{"git"})
+Owner of the @code{gitile} process.
Nguyễn Gia Phong <mcsinyx@disroot.org> writes:
> Seconded, and IMHO the Guix service documentation should mention
> that the default user for gitile is to match the owner
> of the repositories:
As I understand running from git is not secure as it gives gitile
write access to the repos with possibility to corrupt them on error.
I've commented at #71143 about fixing group access for gitile. TLDR:
> (use-modules (git settings))
> (set-owner-validation! #f)
> (run-server ...)
I agree that documentation update is needed. IMO the following, while
being a breaking change, can make the service more sane and flexible:
1. Allow to change user and group as proposed in the initial patch.
2. Set default user and group to "gitile" and document that if they
changed to other values, they expected to exist on a system, to
avoid warnings like "the following groups appear more than once".
3. Remove the default value of the "repositories" field to enforce
users to specify what they want to serve. Document that gitile's
user/group must have at least read access to this directory.
4. Provide configuration for gitolite as an example, not as default.
5. Remove unnecessary fields like "database" from configuration.
I'm interested what authors and maintainers think about all of this.
From 91ec60142ea1220cf4a87883915bf086e1344f69 Mon Sep 17 00:00:00 2001
Message-ID: <91ec60142ea1220cf4a87883915bf086e1344f69.1722437974.git.mail@pisemsky.site>
From: Evgeny Pisemsky <mail@pisemsky.site>
Date: Wed, 31 Jul 2024 17:30:50 +0300
Subject: [PATCH] services: gitile: Allow to set user and group.
Change-Id: I757d7a6c2690326272f0437eda2ba4b2fae409a0
---
doc/guix.texi | 7 +++++
gnu/services/version-control.scm | 45 ++++++++++++++++++++------------
2 files changed, 36 insertions(+), 16 deletions(-)
@@ -129,6 +129,7 @@
Copyright @copyright{} 2024 Richard Sent@*
Copyright @copyright{} 2024 Dariqq@*
Copyright @copyright{} 2024 Denis 'GNUtoo' Carikli@*
+Copyright @copyright{} 2024 Evgeny Pisemsky@*
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -39287,6 +39288,12 @@ Version Control Services
The footer content, as a list of sxml expressions. This is shown on every
page served by Gitile.
+@item @code{user} (default: @code{"git"})
+Owner of the @code{gitile} process.
+
+@item @code{group} (default: @code{"git"})
+Owner's group of the @code{gitile} process.
+
@item @code{nginx}
An nginx server block that will be extended and used as a reverse proxy by
Gitile to serve its pages, and as a normal web server to serve its assets.
@@ -5,6 +5,7 @@
;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
;;; Copyright © 2018 Christopher Baines <mail@cbaines.net>
;;; Copyright © 2021 Julien Lepiller <julien@lepiller.eu>
+;;; Copyright © 2024 Evgeny Pisemsky <mail@pisemsky.site>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -74,6 +75,8 @@ (define-module (gnu services version-control)
gitile-configuration-index-title
gitile-configuration-intro
gitile-configuration-footer
+ gitile-configuration-user
+ gitile-configuration-group
gitile-configuration-nginx
gitile-service-type))
@@ -441,6 +444,10 @@ (define-record-type* <gitile-configuration>
(default '()))
(footer gitile-configuration-footer
(default '()))
+ (user gitile-configuration-user
+ (default "git"))
+ (group gitile-configuration-group
+ (default "git"))
(nginx gitile-configuration-nginx))
(define (gitile-config-file host port database repositories base-git-url
@@ -462,7 +469,7 @@ (define (gitile-config-file host port database repositories base-git-url
(define gitile-nginx-server-block
(match-lambda
(($ <gitile-configuration> package host port database repositories
- base-git-url index-title intro footer nginx)
+ base-git-url index-title intro footer user group nginx)
(list (nginx-server-configuration
(inherit nginx)
(locations
@@ -488,7 +495,7 @@ (define gitile-nginx-server-block
(define gitile-shepherd-service
(match-lambda
(($ <gitile-configuration> package host port database repositories
- base-git-url index-title intro footer nginx)
+ base-git-url index-title intro footer user group nginx)
(list (shepherd-service
(provision '(gitile))
(requirement '(loopback))
@@ -500,21 +507,27 @@ (define gitile-shepherd-service
repositories
base-git-url index-title
intro footer))
- #:user "gitile"
- #:group "git")))
+ #:user #$user
+ #:group #$group)))
(stop #~(make-kill-destructor)))))))
-(define %gitile-accounts
- (list (user-group
- (name "git")
- (system? #t))
- (user-account
- (name "gitile")
- (group "git")
- (system? #t)
- (comment "Gitile user")
- (home-directory "/var/empty")
- (shell (file-append shadow "/sbin/nologin")))))
+(define (gitile-accounts config)
+ (let ((user (gitile-configuration-user config))
+ (group (gitile-configuration-group config)))
+ (filter identity
+ (list
+ (and (equal? group "gitile")
+ (user-group
+ (name "gitile")
+ (system? #t)))
+ (and (equal? user "gitile")
+ (user-account
+ (name "gitile")
+ (group group)
+ (system? #t)
+ (comment "Gitile user")
+ (home-directory "/var/empty")
+ (shell (file-append shadow "/sbin/nologin"))))))))
(define gitile-service-type
(service-type
@@ -523,7 +536,7 @@ (define gitile-service-type
on the web.")
(extensions
(list (service-extension account-service-type
- (const %gitile-accounts))
+ gitile-accounts)
(service-extension shepherd-root-service-type
gitile-shepherd-service)
(service-extension nginx-service-type
base-commit: 01d4363168ed10ea223047f7a7b83201f161ec0b
--
2.45.2