Add cgit role with testing of molecule service

11 files changed, 220 insertions, 0 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14dcba3f..b4bd2f64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,8 @@ jobs:
             runs_on: "ubuntu-latest"
           - name: raspberrypi
             runs_on: "ubuntu-24.04-arm"
+          - name: git
+            runs_on: "ubuntu-latest"
     runs-on: ${{ matrix.molecule_distro.runs_on }}
     steps:
       - uses: actions/checkout@v6
@@ -58,6 +60,7 @@ jobs:
         run: |
           # Use example group_vars files for testing instead of encrypted files
           for f in group_vars/*.example; do mv "$f" "$(echo "$f" | sed s/\.example//)"; done
+          for f in host_vars/*.example; do mv "$f" "$(echo "$f" | sed s/\.example//)"; done
       - name: Run
         env:
           PY_COLORS: 1
diff --git a/molecule/git/Dockerfile.j2 b/molecule/git/Dockerfile.j2
new file mode 100644
index 00000000..4db2119f
--- /dev/null
+++ b/molecule/git/Dockerfile.j2
@@ -0,0 +1,7 @@
+FROM docker.io/library/alpine:3.23
+
+RUN apk add --no-cache python3 openrc \
+    && mkdir -p /run/openrc \
+    && touch /run/openrc/softlevel
+
+CMD ["/sbin/init"]
diff --git a/molecule/git/molecule.yml b/molecule/git/molecule.yml
new file mode 100644
index 00000000..3050dd01
--- /dev/null
+++ b/molecule/git/molecule.yml
@@ -0,0 +1,50 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    requirements-file: ../../requirements.yml
+    ignore-errors: true
+driver:
+  name: podman
+platforms:
+  - name: git
+    image: git
+    dockerfile: Dockerfile.j2
+    platform: "linux/amd64"
+    pre_build_image: false
+    privileged: true
+    command: ${MOLECULE_COMMAND:-"/sbin/init"}
+    tmpfs:
+      "/tmp": "rw"
+      "/run": "rw,exec"
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      host_vars: "../../host_vars/"
+      group_vars: "../../group_vars/"
+      inventory: "../inventory.yml"
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  config_options:
+    defaults:
+      callback_result_format: yaml
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+  playbooks:
+    converge: ../../service.yml
+verifier:
+  name: ansible
+
+scenario:
+  test_sequence:
+    - destroy
+    - syntax
+    - create
+    - converge
+    - idempotence
+    - destroy
diff --git a/molecule/inventory.yml b/molecule/inventory.yml
index dc63becb..47eb69e4 100644
--- a/molecule/inventory.yml
+++ b/molecule/inventory.yml
@@ -7,3 +7,8 @@ homelab:
     proxmox: {}
     raspberrypi: {}
     ubuntu: {}
+
+containers:
+  hosts:
+    git.local:
+      ansible_host: git
diff --git a/roles/cgit/defaults/main.yml b/roles/cgit/defaults/main.yml
new file mode 100644
index 00000000..5acf53fb
--- /dev/null
+++ b/roles/cgit/defaults/main.yml
@@ -0,0 +1,8 @@
+---
+cgit_hostname: "git.example.com"
+cgit_port: 80
+cgit_repos_dir: "/srv/git"
+cgit_title: "git"
+cgit_description: "personal git repositories"
+cgit_clone_prefix: "https://{{ cgit_hostname }}"
+cgit_ssh_user: "git"
diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml
new file mode 100644
index 00000000..d4481590
--- /dev/null
+++ b/roles/cgit/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Restart nginx"
+  become: true
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
diff --git a/roles/cgit/meta/argument_specs.yml b/roles/cgit/meta/argument_specs.yml
new file mode 100644
index 00000000..e0fa14d5
--- /dev/null
+++ b/roles/cgit/meta/argument_specs.yml
@@ -0,0 +1,32 @@
+---
+argument_specs:
+  main:
+    options:
+      cgit_hostname:
+        type: "str"
+        description: "Public hostname for cgit (e.g. git.example.com)"
+        default: "git.example.com"
+      cgit_port:
+        type: "int"
+        description: "Port nginx listens on"
+        default: 80
+      cgit_repos_dir:
+        type: "str"
+        description: "Directory containing bare git repositories"
+        default: "/srv/git"
+      cgit_title:
+        type: "str"
+        description: "cgit index page title"
+        default: "git"
+      cgit_description:
+        type: "str"
+        description: "cgit index page description"
+        default: "personal git repositories"
+      cgit_clone_prefix:
+        type: "str"
+        description: "Clone URL prefix shown in cgit UI"
+        default: "https://{{ cgit_hostname }}"
+      cgit_ssh_user:
+        type: "str"
+        description: "System user for SSH git push access"
+        default: "git"
diff --git a/roles/cgit/meta/main.yml b/roles/cgit/meta/main.yml
new file mode 100644
index 00000000..3b5e8d42
--- /dev/null
+++ b/roles/cgit/meta/main.yml
@@ -0,0 +1,11 @@
+---
+dependencies: []
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure cgit git web viewer"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "Alpine"
+      versions:
+        - "all"
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
new file mode 100644
index 00000000..663534ec
--- /dev/null
+++ b/roles/cgit/tasks/main.yml
@@ -0,0 +1,58 @@
+---
+- name: "Install packages"
+  become: true
+  ansible.builtin.package:
+    name:
+      - cgit
+      - nginx
+      - fcgiwrap
+      - openssh
+    state: present
+
+- name: "Create git user"
+  become: true
+  ansible.builtin.user:
+    name: "{{ cgit_ssh_user }}"
+    shell: "/usr/bin/git-shell"
+    home: "{{ cgit_repos_dir }}"
+    create_home: true
+    system: true
+
+- name: "Create repos directory"
+  become: true
+  ansible.builtin.file:
+    path: "{{ cgit_repos_dir }}"
+    state: directory
+    owner: "{{ cgit_ssh_user }}"
+    group: "{{ cgit_ssh_user }}"
+    mode: "0755"
+
+- name: "Deploy cgitrc"
+  become: true
+  ansible.builtin.template:
+    src: "cgitrc.j2"
+    dest: "/etc/cgitrc"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+
+- name: "Deploy nginx config"
+  become: true
+  ansible.builtin.template:
+    src: "cgit.nginx.conf.j2"
+    dest: "/etc/nginx/http.d/cgit.conf"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: "Restart nginx"
+
+- name: "Enable and start services"
+  become: true
+  ansible.builtin.service:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - nginx
+    - fcgiwrap
+    - sshd
diff --git a/roles/cgit/templates/cgit.nginx.conf.j2 b/roles/cgit/templates/cgit.nginx.conf.j2
new file mode 100644
index 00000000..14256054
--- /dev/null
+++ b/roles/cgit/templates/cgit.nginx.conf.j2
@@ -0,0 +1,19 @@
+server {
+    listen {{ cgit_port }};
+    listen [::]:{{ cgit_port }};
+
+    server_name {{ cgit_hostname }};
+
+    root /usr/share/webapps/cgit;
+
+    try_files $uri @cgit;
+
+    location @cgit {
+        fastcgi_pass unix:/run/fcgiwrap/fcgiwrap.sock;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_param HTTP_HOST $server_name;
+        include fastcgi_params;
+    }
+}
diff --git a/roles/cgit/templates/cgitrc.j2 b/roles/cgit/templates/cgitrc.j2
new file mode 100644
index 00000000..a23e2d0b
--- /dev/null
+++ b/roles/cgit/templates/cgitrc.j2
@@ -0,0 +1,21 @@
+css=/cgit/cgit.css
+logo=/cgit/cgit.png
+
+virtual-root=/
+
+repo.group=personal
+
+root-title={{ cgit_title }}
+root-desc={{ cgit_description }}
+
+clone-prefix={{ cgit_clone_prefix }}
+
+enable-index-links=1
+enable-log-filecount=1
+enable-log-linecount=1
+enable-blame=1
+enable-tree-linenumbers=1
+
+max-stats=year
+
+scan-path={{ cgit_repos_dir }}