Girocco/Config.pm

   1 package Girocco::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6
   7 ## Basic settings
   8
   9 # Name of the service
  10 our $name = "GiroccoEx";
  11
  12 # Title of the service (as shown in gitweb)
  13 our $title = "Example Girocco Hosting";
  14
  15 # Path to the Git binary to use (you MUST set this, even if to /usr/bin/git!)
  16 our $git_bin = '/usr/bin/git';
  17
  18 # E-mail of the site admin
  19 our $admin = 'admin@example.org';
  20
  21 # Girocco branch to use for html.cgi view source links (undef for HEAD)
  22 our $giroccobranch = undef;
  23
  24
  25 ## Feature knobs
  26
  27 # Enable mirroring mode if true
  28 our $mirror = 1;
  29
  30 # Enable push mode if true
  31 our $push = 1;
  32
  33 # Enable user management if true; this means the interface for registering
  34 # user accounts and uploading SSH keys. This implies full chroot.
  35 our $manage_users = 1;
  36
  37 # Enable the special 'mob' user if set to 'mob'
  38 our $mob = "mob";
  39
  40 # Let users set admin passwords; if false, all password inputs are assumed empty.
  41 # This will make new projects use empty passwords and all operations on them
  42 # unrestricted, but you will be able to do no operations on previously created
  43 # projects you have set a password on.
  44 our $project_passwords = 1;
  45
  46 # How to determine project owner; 'email' adds a form item asking for their
  47 # email contact, 'source' takes realname of owner of source repository if it
  48 # is a local path (and empty string otherwise). 'source' is suitable in case
  49 # the site operates only as mirror of purely local-filesystem repositories.
  50 our $project_owners = 'email';
  51
  52 # Which project fields to make editable, out of 'shortdesc', 'homepage',
  53 # 'README', 'notifymail', 'notifyjson', 'notifycia'. (This is currently
  54 # soft restriction - form fields aren't used, but manually injected values
  55 # *are* used. Submit a patch if that's an issue for you.)
  56 our @project_fields = qw(homepage shortdesc README notifymail notifyjson notifycia);
  57
  58 # Minimal number of seconds to pass between two updates of a project.
  59 our $min_mirror_interval = 3600; # 1 hour
  60
  61 # Minimal number of seconds to pass between two garbage collections of a project.
  62 our $min_gc_interval = 604800; # 1 week
  63
  64
  65 ## Paths
  66
  67 # Path where the main chunk of Girocco files will be installed
  68 # This will get COMPLETELY OVERWRITTEN by each make install!!!
  69 our $basedir = '/home/repo/repomgr';
  70
  71 # The repository collection
  72 # "$reporoot-recyclebin" will also be created for use by toolbox/trash-project.pl
  73 our $reporoot = "/srv/git";
  74
  75 # The chroot for ssh pushing; location for project database and other run-time
  76 # data even in non-chroot setups
  77 our $chroot = "/home/repo/j";
  78
  79 # The gitweb files web directory (corresponds to $gitwebfiles)
  80 our $webroot = "/home/repo/WWW";
  81
  82 # The CGI-enabled web directory (corresponds to $gitweburl and $webadmurl)
  83 our $cgiroot = "/home/repo/WWW";
  84
  85 # A web-accessible symlink to $reporoot (corresponds to $httppullurl, can be undef)
  86 our $webreporoot = "/home/repo/WWW/r";
  87
  88
  89 ## URL addresses
  90
  91 # URL of the gitweb.cgi script (must be in pathinfo mode)
  92 our $gitweburl = "http://repo.or.cz/w";
  93
  94 # URL of the extra gitweb files (CSS, .js files, images, ...)
  95 our $gitwebfiles = "http://repo.or.cz";
  96
  97 # URL of the Girocco CGI web admin interface (Girocco cgi/ subdirectory)
  98 our $webadmurl = "http://repo.or.cz";
  99
 100 # URL of the Girocco CGI html templater (Girocco cgi/html.cgi)
 101 our $htmlurl = "http://repo.or.cz/h";
 102
 103 # HTTP URL of the repository collection (undef if N/A)
 104 our $httppullurl = "http://repo.or.cz/r";
 105
 106 # HTTPS push URL of the repository collection (undef if N/A)
 107 our $httpspushurl = undef;
 108
 109 # Git URL of the repository collection (undef if N/A)
 110 # (You need to set up git-daemon on your system, and Girocco will not
 111 # do this particular thing for you.)
 112 our $gitpullurl = "git://repo.or.cz";
 113
 114 # Pushy URL of the repository collection (undef if N/A)
 115 our $pushurl = "ssh://repo.or.cz/srv/git";
 116
 117 # URL of gitweb of this Girocco instance (set to undef if you're not nice
 118 # to the community)
 119 our $giroccourl = "$Girocco::Config::gitweburl/girocco.git";
 120
 121
 122 ## Some templating settings
 123
 124 # Legal warning (on reguser and regproj pages)
 125 our $legalese = <<EOT;
 126 <p>By submitting this form, you are confirming that you will mirror or push
 127 only what we can store and show to anyone else who can visit this site without
 128 breaking any law, and that you will be nice to all small furry animals.
 129 <sup><a href="$Girocco::Config::htmlurl/about.html">(more details)</a></sup>
 130 </p>
 131 EOT
 132
 133 # Pre-configured mirror sources (set to undef for none)
 134 # Arrayref of name - record pairs, the record has these attributes:
 135 #       label: The label of this source
 136 #       url: The template URL; %1, %2, ... will be substituted for inputs
 137 #       desc: Optional VERY short description
 138 #       link: Optional URL to make the desc point at
 139 #       inputs: Arrayref of hashref input records:
 140 #               label: Label of input record
 141 #               suffix: Optional suffix
 142 #       If the inputs arrayref is undef, single URL input is shown,
 143 #       pre-filled with url (probably empty string).
 144 our $mirror_sources = [
 145         {
 146                 label => 'Anywhere',
 147                 url => '',
 148                 desc => 'Any HTTP/Git/rsync pull URL - bring it on!',
 149                 inputs => undef
 150         },
 151         {
 152                 label => 'GitHub',
 153                 url => 'git://github.com/%1/%2.git',
 154                 desc => 'GitHub Social Code Hosting',
 155                 link => 'http://github.com/',
 156                 inputs => [ { label => 'User:' }, { label => 'Project:', suffix => '.git' } ]
 157         },
 158         {
 159                 label => 'Gitorious',
 160                 url => 'git://gitorious.org/%1/%2.git',
 161                 desc => 'Green and Orange Boxes',
 162                 link => 'http://gitorious.org/',
 163                 inputs => [ { label => 'Project:' }, { label => 'Repository:', suffix => '.git' } ]
 164         }
 165 ];
 166
 167 # You can customize the gitweb interface widely by editing
 168 # gitweb/gitweb_config.perl
 169
 170
 171 ## Permission settings
 172
 173 # Note that if you are going to need the fixupd daemon running,
 174 # ($chrooted and $permission_control eq 'Group'), you need to update
 175 # the settings in fixupd/fixupd.sh as well.
 176
 177 # Girocco needs some way to manipulate write permissions to various parts of
 178 # all repositories; this concerns three entities:
 179 # - www-data: the web interface needs to be able to rewrite few files within
 180 # the repository
 181 # - repo: a user designated for cronjobs; handles mirroring and repacking;
 182 # this one is optional if not $mirror
 183 # - others: the designated users that are supposed to be able to push; they
 184 # may have account either within chroot, or outside of it
 185
 186 # There are several ways how to use Girocco based on a combination of the
 187 # following settings.
 188
 189 # (Non-chroot) UNIX user the CGI scripts run on; note that if some non-related
 190 # untrusted CGI scripts run on this account too, that can be a big security
 191 # problem and you'll probably need to set up suexec (poor you).
 192 our $cgi_user = 'www-data';
 193
 194 # (Non-chroot) UNIX user performing mirroring jobs; this is the user who
 195 # should run all the daemons and cronjobs (except the fixupd) and
 196 # the user who should be running make install (if not root).
 197 our $mirror_user = 'repo';
 198
 199 # (Non-chroot) UNIX group owning the repositories by default; it owns whole
 200 # mirror repositories and at least web-writable metadata of push repositories.
 201 # If you undefine this, all the data will become WORLD-WRITABLE.
 202 # Both $cgi_user and $mirror_user should be members of this group!
 203 our $owning_group = 'repo';
 204
 205 # Whether to use chroot jail for pushing; this must be always the same
 206 # as $manage_users.
 207 # TODO: Gitosis support for $manage_users and not $chrooted?
 208 our $chrooted = $manage_users;
 209
 210 # How to control permissions of push-writable data in push repositories:
 211 # * 'Group' for the traditional model: The $chroot/etc/group project database
 212 #   file is used as the UNIX group(5) file; the directories have gid appropriate
 213 #   for the particular repository and are group-writable. This works only if
 214 #   $chrooted so that users are put in the proper groups on login. This requires
 215 #   you also to set up the fixupd/fixupd.sh daemon for root.
 216 # * 'ACL' for a model based on POSIX ACL: The directories are coupled with ACLs
 217 #   listing the users with push permissions. This works for both chroot and
 218 #   non-chroot setups, however it requires ACL support within the filesystem.
 219 #   This option is BASICALLY UNTESTED, too. And UNIMPLEMENTED. :-)
 220 # * 'Hooks' for a relaxed model: The directories are world-writable and push
 221 #   permission control is purely hook-driven. This is INSECURE and works only
 222 #   when you trust all your users; on the other hand, the attack vectors are
 223 #   mostly just DoS or fully-traceable tinkering.
 224 our $permission_control = 'Group';
 225
 226 # Path to named pipe for fixing up project permissions
 227 # Will be read by fixupd.sh
 228 our $fixup_queue = '/var/tmp/fixup.fifo';
 229
 230 # Couple of sanity checks
 231 ($mirror or $push) or die "Girocco::Config: neither \$mirror or \$push is set?!";
 232 (not $push or ($pushurl or $gitpullurl or $httppullurl)) or die "Girocco::Config: no pull URL is set";
 233 (not $push or $pushurl) or die "Girocco::Config: \$push set but \$pushurl is undef";
 234 (not $mirror or $mirror_user) or die "Girocco::Config: \$mirror set but \$mirror_user is undef";
 235 ($manage_users == $chrooted) or die "Girocco::Config: \$manage_users and \$chrooted must be set to the same value";
 236 (not $chrooted or $permission_control ne 'ACL') or die "Girocco::Config: resolving uids for ACL not supported when using chroot";
 237 (grep { $permission_control eq $_ } qw(Group Hooks)) or die "Girocco::Config: \$permission_control must be set to Group or Hooks";
 238 ($chrooted or not $mob) or die "Girocco::Config: mob user supported only in the chrooted mode";
 239
 240
 241 1;