Refactor pve cgit to use generic proxy

This is refactoring the PoC for deploying cgit on pve, to now move to a
more standard deployment with dedicated agnonstic proxy role/container

8 files changed, 119 insertions, 26 deletions

diff --git a/roles/cgit/defaults/main.yml b/roles/cgit/defaults/main.yml
index 5acf53fb..02168d34 100644
--- a/roles/cgit/defaults/main.yml
+++ b/roles/cgit/defaults/main.yml
@@ -1,8 +1,9 @@
 ---
 cgit_hostname: "git.example.com"
-cgit_port: 80
+cgit_port: 3000
 cgit_repos_dir: "/srv/git"
 cgit_title: "git"
 cgit_description: "personal git repositories"
-cgit_clone_prefix: "https://{{ cgit_hostname }}"
+cgit_clone_prefix: "ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}"
 cgit_ssh_user: "git"
+cgit_proxy_host: "proxy.home.arpa"
diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml
index d4481590..52ffdbee 100644
--- a/roles/cgit/handlers/main.yml
+++ b/roles/cgit/handlers/main.yml
@@ -1,6 +1,20 @@
 ---
+- name: "Restart lighttpd"
+  become: true
+  ansible.builtin.service:
+    name: lighttpd
+    state: restarted
+
+- name: "Restart caddy"
+  become: true
+  delegate_to: "{{ cgit_proxy_host }}"
+  ansible.builtin.service:
+    name: caddy
+    state: restarted
+
 - name: "Restart nginx"
   become: true
+  delegate_to: "{{ cgit_proxy_host }}"
   ansible.builtin.service:
     name: nginx
     state: restarted
diff --git a/roles/cgit/meta/argument_specs.yml b/roles/cgit/meta/argument_specs.yml
index e0fa14d5..9dbe28b1 100644
--- a/roles/cgit/meta/argument_specs.yml
+++ b/roles/cgit/meta/argument_specs.yml
@@ -8,8 +8,8 @@ argument_specs:
         default: "git.example.com"
       cgit_port:
         type: "int"
-        description: "Port nginx listens on"
-        default: 80
+        description: "Port lighttpd listens on internally"
+        default: 3000
       cgit_repos_dir:
         type: "str"
         description: "Directory containing bare git repositories"
@@ -25,8 +25,12 @@ argument_specs:
       cgit_clone_prefix:
         type: "str"
         description: "Clone URL prefix shown in cgit UI"
-        default: "https://{{ cgit_hostname }}"
+        default: "ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}"
       cgit_ssh_user:
         type: "str"
         description: "System user for SSH git push access"
         default: "git"
+      cgit_proxy_host:
+        type: "str"
+        description: "Inventory hostname of the proxy container to deploy vhost on"
+        default: "proxy.home.arpa"
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
index fed97fef..17a5675b 100644
--- a/roles/cgit/tasks/main.yml
+++ b/roles/cgit/tasks/main.yml
@@ -4,8 +4,7 @@
   ansible.builtin.package:
     name:
       - cgit
-      - nginx
-      - fcgiwrap
+      - lighttpd
       - openssh
     state: present
 
@@ -43,15 +42,61 @@
     group: "root"
     mode: "0644"
 
-- name: "Deploy nginx config"
+- name: "Deploy lighttpd config"
   become: true
   ansible.builtin.template:
-    src: "cgit.nginx.conf.j2"
-    dest: "/etc/nginx/http.d/cgit.conf"
+    src: "cgit.lighttpd.conf.j2"
+    dest: "/etc/lighttpd/lighttpd.conf"
     owner: "root"
     group: "root"
     mode: "0644"
-  notify: "Restart nginx"
+  notify: "Restart lighttpd"
+
+- name: "Deploy caddy vhost on proxy"
+  when: hostvars[cgit_proxy_host]['proxy_type'] == "caddy"
+  delegate_to: "{{ cgit_proxy_host }}"
+  block:
+    - name: "Ensure caddy sites directory exists"
+      become: true
+      ansible.builtin.file:
+        path: "/etc/caddy/sites"
+        state: directory
+        owner: "root"
+        group: "caddy"
+        mode: "0750"
+
+    - name: "Deploy caddy vhost"
+      become: true
+      ansible.builtin.template:
+        src: "cgit.caddy.j2"
+        dest: "/etc/caddy/sites/{{ cgit_hostname }}.caddy"
+        owner: "root"
+        group: "caddy"
+        mode: "0640"
+      notify: "Restart caddy"
+
+- name: "Deploy nginx vhost on proxy"
+  when: hostvars[cgit_proxy_host]['proxy_type'] == "nginx"
+  delegate_to: "{{ cgit_proxy_host }}"
+  block:
+    - name: "Ensure nginx vhosts directory exists"
+      become: true
+      ansible.builtin.file:
+        path: "/etc/nginx/vhosts.d"
+        state: directory
+        owner: "root"
+        group: "root"
+        mode: "0755"
+
+    - name: "Deploy nginx vhost"
+      become: true
+      ansible.builtin.template:
+        src: "cgit.nginx.conf.j2"
+        dest: "/etc/nginx/vhosts.d/{{ cgit_hostname }}.conf"
+        owner: "root"
+        group: "root"
+        mode: "0644"
+      notify: "Restart nginx"
 
 - name: "Enable and start services"
   become: true
@@ -60,6 +105,5 @@
     enabled: true
     state: started
   loop:
-    - nginx
-    - fcgiwrap
+    - lighttpd
     - sshd
diff --git a/roles/cgit/templates/cgit.caddy.j2 b/roles/cgit/templates/cgit.caddy.j2
new file mode 100644
index 00000000..8ddc6d88
--- /dev/null
+++ b/roles/cgit/templates/cgit.caddy.j2
@@ -0,0 +1,3 @@
+{{ cgit_hostname }} {
+	reverse_proxy {{ network_ipv4_address }}:{{ cgit_port }}
+}
diff --git a/roles/cgit/templates/cgit.lighttpd.conf.j2 b/roles/cgit/templates/cgit.lighttpd.conf.j2
new file mode 100644
index 00000000..0fd1d535
--- /dev/null
+++ b/roles/cgit/templates/cgit.lighttpd.conf.j2
@@ -0,0 +1,24 @@
+server.port = {{ cgit_port }}
+server.bind = "{{ network_ipv4_address }}"
+server.modules = ("mod_cgi", "mod_rewrite")
+
+server.document-root = "/usr/share/webapps/cgit"
+server.pid-file = "/run/lighttpd.pid"
+
+mimetype.assign = (
+    ".css"  => "text/css",
+    ".png"  => "image/png",
+    ".ico"  => "image/x-icon",
+    ".txt"  => "text/plain",
+    ".html" => "text/html",
+)
+
+cgi.assign = (".cgi" => "")
+
+url.rewrite-once = (
+    "^/cgit\.css$"     => "/cgit.css",
+    "^/cgit\.png$"     => "/cgit.png",
+    "^/favicon\.ico$"  => "/favicon.ico",
+    "^/robots\.txt$"   => "/robots.txt",
+    "^(/.*)?$"         => "/cgit.cgi$1",
+)
diff --git a/roles/cgit/templates/cgit.nginx.conf.j2 b/roles/cgit/templates/cgit.nginx.conf.j2
index 14256054..62fa6669 100644
--- a/roles/cgit/templates/cgit.nginx.conf.j2
+++ b/roles/cgit/templates/cgit.nginx.conf.j2
@@ -1,19 +1,22 @@
 server {
-    listen {{ cgit_port }};
-    listen [::]:{{ cgit_port }};
+    listen 80;
+    listen [::]:80;
 
     server_name {{ cgit_hostname }};
 
-    root /usr/share/webapps/cgit;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name {{ cgit_hostname }};
 
-    try_files $uri @cgit;
+    ssl_certificate {{ nginx_ssl_certificate }};
+    ssl_certificate_key {{ nginx_ssl_certificate_key }};
 
-    location @cgit {
-        fastcgi_pass unix:/run/fcgiwrap/fcgiwrap.sock;
-        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
-        fastcgi_param PATH_INFO $uri;
-        fastcgi_param QUERY_STRING $args;
-        fastcgi_param HTTP_HOST $server_name;
-        include fastcgi_params;
+    location / {
+        proxy_pass http://{{ network_ipv4_address }}:{{ cgit_port }};
     }
 }
diff --git a/roles/cgit/templates/cgitrc.j2 b/roles/cgit/templates/cgitrc.j2
index a23e2d0b..89578a7c 100644
--- a/roles/cgit/templates/cgitrc.j2
+++ b/roles/cgit/templates/cgitrc.j2
@@ -1,5 +1,5 @@
-css=/cgit/cgit.css
-logo=/cgit/cgit.png
+css=/cgit.css
+logo=/cgit.png
 
 virtual-root=/