Girocco/Config.pm

   1 package Girocco::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6
   7 ## Basic settings
   8
   9 # Name of the service
  10 our $name = "GiroccoEx";
  11
  12 # Title of the service (as shown in gitweb)
  13 our $title = "Example Girocco Hosting";
  14
  15 # Path to the Git binary to use (you MUST set this, even if to /usr/bin/git!)
  16 our $git_bin = '/usr/bin/git';
  17
  18 # E-mail of the site admin
  19 our $admin = 'admin@example.org';
  20
  21 # Girocco branch to use for html.cgi view source links (undef for HEAD)
  22 our $giroccobranch = undef;
  23
  24
  25 ## Feature knobs
  26
  27 # Enable mirroring mode if true
  28 our $mirror = 1;
  29
  30 # Enable push mode if true
  31 our $push = 1;
  32
  33 # Enable user management if true; this means the interface for registering
  34 # user accounts and uploading SSH keys. This implies full chroot.
  35 our $manage_users = 1;
  36
  37 # Enable the special 'mob' user if set to 'mob'
  38 our $mob = "mob";
  39
  40 # Let users set admin passwords; if false, all password inputs are assumed empty.
  41 # This will make new projects use empty passwords and all operations on them
  42 # unrestricted, but you will be able to do no operations on previously created
  43 # projects you have set a password on.
  44 our $project_passwords = 1;
  45
  46 # How to determine project owner; 'email' adds a form item asking for their
  47 # email contact, 'source' takes realname of owner of source repository if it
  48 # is a local path (and empty string otherwise). 'source' is suitable in case
  49 # the site operates only as mirror of purely local-filesystem repositories.
  50 our $project_owners = 'email';
  51
  52 # Which project fields to make editable, out of 'shortdesc', 'homepage',
  53 # 'README', 'notifymail', 'notifyjson', 'notifycia'. (This is currently
  54 # soft restriction - form fields aren't used, but manually injected values
  55 # *are* used. Submit a patch if that's an issue for you.)
  56 our @project_fields = qw(homepage shortdesc README notifymail notifyjson notifycia);
  57
  58 # Minimal number of seconds to pass between two updates of a project.
  59 our $min_mirror_interval = 3600; # 1 hour
  60
  61 # Minimal number of seconds to pass between two garbage collections of a project.
  62 our $min_gc_interval = 604800; # 1 week
  63
  64
  65 ## Paths
  66
  67 # Path where the main chunk of Girocco files will be installed
  68 # This will get COMPLETELY OVERWRITTEN by each make install!!!
  69 our $basedir = '/home/repo/repomgr';
  70
  71 # The repository collection
  72 our $reporoot = "/srv/git";
  73
  74 # The chroot for ssh pushing; location for project database and other run-time
  75 # data even in non-chroot setups
  76 our $chroot = "/home/repo/j";
  77
  78 # The gitweb files web directory (corresponds to $gitwebfiles)
  79 our $webroot = "/home/repo/WWW";
  80
  81 # The CGI-enabled web directory (corresponds to $gitweburl and $webadmurl)
  82 our $cgiroot = "/home/repo/WWW";
  83
  84 # A web-accessible symlink to $reporoot (corresponds to $httppullurl, can be undef)
  85 our $webreporoot = "/home/repo/WWW/r";
  86
  87
  88 ## URL addresses
  89
  90 # URL of the gitweb.cgi script (must be in pathinfo mode)
  91 our $gitweburl = "http://repo.or.cz/w";
  92
  93 # URL of the extra gitweb files (CSS, .js files, images, ...)
  94 our $gitwebfiles = "http://repo.or.cz";
  95
  96 # URL of the Girocco CGI web admin interface (Girocco cgi/ subdirectory)
  97 our $webadmurl = "http://repo.or.cz";
  98
  99 # URL of the Girocco CGI html templater (Girocco cgi/html.cgi)
 100 our $htmlurl = "http://repo.or.cz/h";
 101
 102 # HTTP URL of the repository collection (undef if N/A)
 103 our $httppullurl = "http://repo.or.cz/r";
 104
 105 # Git URL of the repository collection (undef if N/A)
 106 # (You need to set up git-daemon on your system, and Girocco will not
 107 # do this particular thing for you.)
 108 our $gitpullurl = "git://repo.or.cz";
 109
 110 # Pushy URL of the repository collection (undef if N/A)
 111 our $pushurl = "ssh://repo.or.cz/srv/git";
 112
 113 # URL of gitweb of this Girocco instance (set to undef if you're not nice
 114 # to the community)
 115 our $giroccourl = "$Girocco::Config::gitweburl/girocco.git";
 116
 117
 118 ## Some templating settings
 119
 120 # Legal warning (on reguser and regproj pages)
 121 our $legalese = <<EOT;
 122 <p>By submitting this form, you are confirming that you will mirror or push
 123 only what we can store and show to anyone else who can visit this site without
 124 breaking any law, and that you will be nice to all small furry animals.
 125 <sup><a href="$Girocco::Config::htmlurl/about.html">(more details)</a></sup>
 126 </p>
 127 EOT
 128
 129 # Pre-configured mirror sources (set to undef for none)
 130 # Arrayref of name - record pairs, the record has these attributes:
 131 #       label: The label of this source
 132 #       url: The template URL; %1, %2, ... will be substituted for inputs
 133 #       desc: Optional VERY short description
 134 #       link: Optional URL to make the desc point at
 135 #       inputs: Arrayref of hashref input records:
 136 #               label: Label of input record
 137 #               suffix: Optional suffix
 138 #       If the inputs arrayref is undef, single URL input is shown,
 139 #       pre-filled with url (probably empty string).
 140 our $mirror_sources = [
 141         {
 142                 label => 'Anywhere',
 143                 url => '',
 144                 desc => 'Any HTTP/Git/rsync pull URL - bring it on!',
 145                 inputs => undef
 146         },
 147         {
 148                 label => 'GitHub',
 149                 url => 'git://github.com/%1/%2.git',
 150                 desc => 'GitHub Social Code Hosting',
 151                 link => 'http://github.com/',
 152                 inputs => [ { label => 'User:' }, { label => 'Project:', suffix => '.git' } ]
 153         },
 154         {
 155                 label => 'Gitorious',
 156                 url => 'git://gitorious.org/%1/%2.git',
 157                 desc => 'Green and Orange Boxes',
 158                 link => 'http://gitorious.org/',
 159                 inputs => [ { label => 'Project:' }, { label => 'Repository:', suffix => '.git' } ]
 160         }
 161 ];
 162
 163 # You can customize the gitweb interface widely by editing
 164 # gitweb/gitweb_config.perl
 165
 166
 167 ## Permission settings
 168
 169 # Note that if you are going to need the fixupd daemon running,
 170 # ($chrooted and $permission_control eq 'Group'), you need to update
 171 # the settings in fixupd/fixupd.sh as well.
 172
 173 # Girocco needs some way to manipulate write permissions to various parts of
 174 # all repositories; this concerns three entities:
 175 # - www-data: the web interface needs to be able to rewrite few files within
 176 # the repository
 177 # - repo: a user designated for cronjobs; handles mirroring and repacking;
 178 # this one is optional if not $mirror
 179 # - others: the designated users that are supposed to be able to push; they
 180 # may have account either within chroot, or outside of it
 181
 182 # There are several ways how to use Girocco based on a combination of the
 183 # following settings.
 184
 185 # (Non-chroot) UNIX user the CGI scripts run on; note that if some non-related
 186 # untrusted CGI scripts run on this account too, that can be a big security
 187 # problem and you'll probably need to set up suexec (poor you).
 188 our $cgi_user = 'www-data';
 189
 190 # (Non-chroot) UNIX user performing mirroring jobs; this is the user who
 191 # should run all the daemons and cronjobs (except the fixupd) and
 192 # the user who should be running make install (if not root).
 193 our $mirror_user = 'repo';
 194
 195 # (Non-chroot) UNIX group owning the repositories by default; it owns whole
 196 # mirror repositories and at least web-writable metadata of push repositories.
 197 # If you undefine this, all the data will become WORLD-WRITABLE.
 198 # Both $cgi_user and $mirror_user should be members of this group!
 199 our $owning_group = 'repo';
 200
 201 # Whether to use chroot jail for pushing; this must be always the same
 202 # as $manage_users.
 203 # TODO: Gitosis support for $manage_users and not $chrooted?
 204 our $chrooted = $manage_users;
 205
 206 # How to control permissions of push-writable data in push repositories:
 207 # * 'Group' for the traditional model: The $chroot/etc/group project database
 208 #   file is used as the UNIX group(5) file; the directories have gid appropriate
 209 #   for the particular repository and are group-writable. This works only if
 210 #   $chrooted so that users are put in the proper groups on login. This requires
 211 #   you also to set up the fixupd/fixupd.sh daemon for root.
 212 # * 'ACL' for a model based on POSIX ACL: The directories are coupled with ACLs
 213 #   listing the users with push permissions. This works for both chroot and
 214 #   non-chroot setups, however it requires ACL support within the filesystem.
 215 #   This option is BASICALLY UNTESTED, too. And UNIMPLEMENTED. :-)
 216 # * 'Hooks' for a relaxed model: The directories are world-writable and push
 217 #   permission control is purely hook-driven. This is INSECURE and works only
 218 #   when you trust all your users; on the other hand, the attack vectors are
 219 #   mostly just DoS or fully-traceable tinkering.
 220 our $permission_control = 'Group';
 221
 222 # Path to named pipe for fixing up project permissions
 223 # Will be read by fixupd.sh
 224 our $fixup_queue = '/var/tmp/fixup.fifo';
 225
 226 # Couple of sanity checks
 227 ($mirror or $push) or die "Girocco::Config: neither \$mirror or \$push is set?!";
 228 (not $push or ($pushurl or $gitpullurl or $httppullurl)) or die "Girocco::Config: no pull URL is set";
 229 (not $push or $pushurl) or die "Girocco::Config: \$push set but \$pushurl is undef";
 230 (not $mirror or $mirror_user) or die "Girocco::Config: \$mirror set but \$mirror_user is undef";
 231 ($manage_users == $chrooted) or die "Girocco::Config: \$manage_users and \$chrooted must be set to the same value";
 232 (not $chrooted or $permission_control ne 'ACL') or die "Girocco::Config: resolving uids for ACL not supported when using chroot";
 233 (grep { $permission_control eq $_ } qw(Group Hooks)) or die "Girocco::Config: \$permission_control must be set to Group or Hooks";
 234 ($chrooted or not $mob) or die "Girocco::Config: mob user supported only in the chrooted mode";
 235
 236
 237 1;