Girocco/Config.pm

   1 package Girocco::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6
   7 ## Basic settings
   8
   9 # Name of the service
  10 our $name = "repo.or.cz";
  11
  12 # Title of the service (as shown in gitweb)
  13 our $title = "Public Git Hosting";
  14
  15 # Path to the Git binary to use (you MUST set this, even if to /usr/bin/git!)
  16 our $git_bin = '/usr/bin/git';
  17
  18 # E-mail of the site admin
  19 our $admin = 'pasky@suse.cz';
  20
  21
  22 ## Feature knobs
  23
  24 # Enable mirroring mode if true
  25 our $mirror = 1;
  26
  27 # Enable push mode if true
  28 our $push = 1;
  29
  30 # Enable user management if true
  31 our $manage_users = 1;
  32
  33 # Enable the special 'mob' user if set to 'mob'
  34 our $mob = "mob";
  35
  36 # Let users set admin passwords; if false, all password inputs are assumed empty.
  37 # This will make new projects use empty passwords and all operations on them
  38 # unrestricted, but you will be able to do no operations on previously created
  39 # projects you have set a password on.
  40 our $project_passwords = 1;
  41
  42 # How to determine project owner; 'email' adds a form item asking for their
  43 # email contact, 'source' takes realname of owner of source repository if it
  44 # is a local path (and empty string otherwise).
  45 our $project_owners = 'email';
  46
  47 # Which project fields to make editable, out of 'shortdesc', 'homepage',
  48 # 'README':
  49 our @project_fields = qw(homepage shortdesc README);
  50
  51 # Minimal number of seconds to pass between two updates of a project.
  52 our $min_mirror_interval = 3600; # 1 hour
  53
  54 # Minimal number of seconds to pass between two garbage collections of a project.
  55 our $min_gc_interval = 604800; # 1 week
  56
  57
  58 ## Paths
  59
  60 # Path to the Girocco files (checkout of this project)
  61 # This will get COMPLETELY OVERWRITTEN by each make install!
  62 our $basedir = '/home/repo/repomgr';
  63
  64 # The repository collection
  65 our $reporoot = "/srv/git";
  66
  67 # The chroot for ssh pushing; location for project database even in non-chroot
  68 # setups
  69 our $chroot = "/home/repo/j";
  70
  71 # The gitweb files web directory (corresponds to $gitwebfiles)
  72 our $webroot = "/home/repo/WWW";
  73
  74 # The CGI-enabled web directory (corresponds to $gitweburl and $webadmurl)
  75 our $cgiroot = "/home/repo/WWW";
  76
  77 # A web-accessible symlink to $reporoot (corresponds to $httppullurl, can be undef)
  78 our $webreporoot = "/home/repo/WWW/r";
  79
  80
  81 ## URL addresses
  82
  83 # URL of the gitweb.cgi script (must be in pathinfo mode)
  84 our $gitweburl = "http://repo.or.cz/w";
  85
  86 # URL of the extra gitweb files (CSS, .js files, images, ...)
  87 our $gitwebfiles = "http://repo.or.cz";
  88
  89 # URL of the Girocco CGI web admin interface (Girocco cgi/ subdirectory)
  90 our $webadmurl = "http://repo.or.cz";
  91
  92 # URL of the Girocco CGI html templater (Girocco cgi/html.cgi)
  93 our $htmlurl = "http://repo.or.cz/h";
  94
  95 # HTTP URL of the repository collection (undef if N/A)
  96 our $httppullurl = "http://repo.or.cz/r";
  97
  98 # Git URL of the repository collection (undef if N/A)
  99 our $gitpullurl = "git://repo.or.cz";
 100
 101 # Pushy URL of the repository collection (undef if N/A)
 102 our $pushurl = "ssh://repo.or.cz/srv/git";
 103
 104 # URL of gitweb of this Girocco instance (set to undef if you're not nice
 105 # to the community)
 106 our $giroccourl = "$Girocco::Config::gitweburl/repo.git";
 107
 108
 109 ## Some templating settings
 110
 111 # Legal warning (on reguser and regproj pages)
 112 our $legalese = <<EOT;
 113 <p>By submitting this form, you are confirming that you will mirror or push
 114 only free software and redistributing it will not violate any law
 115 of Czech Republic.
 116 <sup><a href="$Girocco::Config::htmlurl/about.html">(more details)</a></sup>
 117 </p>
 118 EOT
 119
 120 # Pre-configured mirror sources (set to undef for none)
 121 # Arrayref of name - record pairs, the record has these attributes:
 122 #       label: The label of this source
 123 #       url: The template URL; %1, %2, ... will be substituted for inputs
 124 #       desc: Optional VERY short description
 125 #       link: Optional URL to make the desc point at
 126 #       inputs: Arrayref of hashref input records:
 127 #               label: Label of input record
 128 #               suffix: Optional suffix
 129 #       If the inputs arrayref is undef, single URL input is shown,
 130 #       pre-filled with url (probably empty string).
 131 our $mirror_sources = [
 132         {
 133                 label => 'Anywhere',
 134                 url => '',
 135                 desc => 'Any HTTP/Git/rsync pull URL - bring it on!',
 136                 inputs => undef
 137         },
 138         {
 139                 label => 'GitHub',
 140                 url => 'git://github.com/%1/%2.git',
 141                 desc => 'GitHub Social Code Hosting',
 142                 link => 'http://github.com/',
 143                 inputs => [ { label => 'User:' }, { label => 'Project:', suffix => '.git' } ]
 144         },
 145         {
 146                 label => 'Gitorious',
 147                 url => 'git://gitorious.org/%1/%2.git',
 148                 desc => 'Green and Orange Boxes',
 149                 link => 'http://gitorious.org/',
 150                 inputs => [ { label => 'Project:' }, { label => 'Repository:', suffix => '.git' } ]
 151         }
 152 ];
 153
 154
 155 ## Permission settings
 156
 157 # Note that if you are going to need the fixup root cronjob
 158 # ($chrooted and $permission_control eq 'Group'), you need to update
 159 # the settings in jobs/fixup.sh as well.
 160
 161 # Girocco needs some way to manipulate write permissions to various parts of
 162 # all repositories; this concerns three entities:
 163 # - www-data: the web interface needs to be able to rewrite few files within
 164 # the repository
 165 # - repo: a user designated for cronjobs; handles mirroring and repacking;
 166 # this one is optional if not $mirror
 167 # - others: the designated users that are supposed to be able to push
 168
 169 # There are several ways how to use Girocco based on a combination of the
 170 # following settings.
 171
 172 # (Non-chroot) UNIX user the CGI scripts run on
 173 our $cgi_user = 'www-data';
 174
 175 # (Non-chroot) UNIX user performing mirroring jobs
 176 our $mirror_user = 'repo';
 177
 178 # (Non-chroot) UNIX group owning the repositories by default; it owns whole
 179 # mirror repositories and at least web-writable metadata of push repositories.
 180 # If you undefine this, all the data will become WORLD-WRITABLE.
 181 # Both $cgi_user and $mirror_user should be members of this group.
 182 our $owning_group = 'repo';
 183
 184 # Whether to use chroot jail for pushing; this must be always the same
 185 # as $manage_users.
 186 # TODO: Gitosis support for $manage_users and not $chrooted?
 187 our $chrooted = $manage_users;
 188
 189 # How to control permissions of push-writable data in push repositories:
 190 # * 'Group' for the traditional model: The $chroot/etc/group project database
 191 #   file is used as the UNIX group(5) file; the directories have gid appropriate
 192 #   for the particular repository and are group-writable. This works only if
 193 #   $chrooted so that users are put in the proper groups on login. This requires
 194 #   you also to set up the very crude fixup.sh cronjob for root.
 195 # * 'ACL' for a model based on POSIX ACL: The directories are coupled with ACLs
 196 #   listing the users with push permissions. This works for both chroot and
 197 #   non-chroot setups, however it requires ACL support within the filesystem.
 198 #   This option is BASICALLY UNTESTED, too. And UNIMPLEMENTED. :-)
 199 # * 'Hooks' for a relaxed model: The directories are world-writable and push
 200 #   permission control is purely hook-driven. This is INSECURE and works only
 201 #   when you trust all your users; on the other hand, the attack vectors are
 202 #   mostly just DoS or fully-traceable tinkering.
 203 our $permission_control = 'Group';
 204
 205
 206 # Couple of sanity checks
 207 ($mirror or $push) or die "Girocco::Config: neither \$mirror or \$push is set?!";
 208 (not $push or ($pushurl or $gitpullurl or $httppullurl)) or die "Girocco::Config: no pull URL is set";
 209 (not $push or $pushurl) or die "Girocco::Config: \$push set but \$pushurl is undef";
 210 (not $mirror or $mirror_user) or die "Girocco::Config: \$mirror set but \$mirror_user is undef";
 211 ($manage_users == $chrooted) or die "Girocco::Config: \$manage_users and \$chrooted must be set to the same value";
 212 (not $chrooted or $permission_control ne 'ACL') or die "Girocco::Config: resolving uids for ACL not supported when using chroot";
 213 (grep { $permission_control eq $_ } qw(Group Hooks)) or die "Girocco::Config: \$permission_control must be set to Group or Hooks";
 214 ($chrooted or not $mob) or die "Girocco::Config: mob user supported only in the chrooted mode";
 215
 216
 217 1;