From 0fa75ea8e374b39ac80d3a5e4bed51bb392ba752 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Sun, 26 Jul 2026 04:20:09 +0200 Subject: Give git user its own home, separate from /srv/git MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit authorized_keys lived under /srv/git (git's $HOME), the same tree restic backs up and restores. backup couldn't even read it (0700, unreadable by the backup user), and restore --delete treated it as extraneous and deleted it, breaking push access after every restore. git now gets a normal separate home; clone-prefix in cgitrc serves the repos dir by absolute path instead of the ~-relative form, since that relied on $HOME being the repos dir. Drops the sshd_config.d Include/ Match-block/AllowUsers approach tried first — it directly conflicted with pve-lxc-ssh's sshd_config push, which fully overwrites the file on every run and has no way to know about cgit's edits. Co-Authored-By: Claude.ai --- roles/cgit/meta/argument_specs.yml | 8 -------- 1 file changed, 8 deletions(-) (limited to 'roles/cgit/meta/argument_specs.yml') diff --git a/roles/cgit/meta/argument_specs.yml b/roles/cgit/meta/argument_specs.yml index 3e80987e..08f732f6 100644 --- a/roles/cgit/meta/argument_specs.yml +++ b/roles/cgit/meta/argument_specs.yml @@ -22,14 +22,6 @@ argument_specs: type: "str" description: "cgit index page description" default: "personal git repositories" - cgit_clone_prefix: - type: "str" - description: >- - Clone URL prefix shown in cgit UI. Uses /~ (home-relative, resolves - against cgit_ssh_user's home / cgit_repos_dir) instead of the literal - cgit_repos_dir path, so the server's filesystem layout isn't exposed - in URLs shown to anyone browsing the web UI - default: "ssh://{{ cgit_ssh_user }}@{{ cgit_hostname }}:{{ ssh_port }}/~" cgit_ssh_user: type: "str" description: "System user for SSH git push access" -- cgit v1.2.3