4 files changed, 136 insertions, 0 deletions
diff --git a/chaos-at-home/ch-mimas.yml b/chaos-at-home/ch-mimas.yml
index db661b0a..c25bf1d2 100644
--- a/chaos-at-home/ch-mimas.yml
+++ b/chaos-at-home/ch-mimas.yml
@@ -15,3 +15,4 @@
   - role: apt-repo/spreadspace
   - role: nginx/base
   - role: monitoring/prometheus/exporter
+  - role: gitolite/base
diff --git a/inventory/host_vars/ch-mimas.yml b/inventory/host_vars/ch-mimas.yml
index 1b3525a8..8189958e 100644
--- a/inventory/host_vars/ch-mimas.yml
+++ b/inventory/host_vars/ch-mimas.yml
@@ -12,6 +12,9 @@ spreadspace_apt_repo_components:
   - prometheus
 
 
+sshd_allowusers_host: "{{ admin_users_host + (['git'] | product(gitolite_instances | list) | map('join', '-')) }}"
+
+
 ntp_variant: systemd-timesyncd
 
 
@@ -86,3 +89,15 @@ prometheus_job_multitarget_blackbox__probe:
   - instance: "https-mimas.chaos-at-home.org"
     target: "https://mimas.chaos-at-home.org"
     module: http_tls_2xx
+
+
+gitolite_storage:
+  type: lvm
+  vg: "{{ host_name }}"
+  lv: git
+  size: 1G
+  fs: ext4
+
+gitolite_instances:
+  spreadspace:
+    primary_admin_key: "{{ users.equinox.ssh | first }}"
diff --git a/roles/gitolite/base/defaults/main.yml b/roles/gitolite/base/defaults/main.yml
new file mode 100644
index 00000000..8016135a
--- /dev/null
+++ b/roles/gitolite/base/defaults/main.yml
@@ -0,0 +1,20 @@
+---
+gitolite_base_path: /srv/git
+
+# gitolite_storage:
+#   ...
+
+# gitolite_instances:
+#   example:
+#     umask: '0077'
+#     primary_admin_key: "ssh-ed25519 ..."
+#     http:
+#       hostnames:
+#       - git.example.com
+#       authentication: basic
+#       users:
+#         user1: password
+#       enable_git_backend: yes
+#       title: cgit root title
+#       description: this will be shown by cgit below the title
+#       logo: path/to/logo/file/on/ansible/controller.png
diff --git a/roles/gitolite/base/tasks/main.yml b/roles/gitolite/base/tasks/main.yml
new file mode 100644
index 00000000..440d9f52
--- /dev/null
+++ b/roles/gitolite/base/tasks/main.yml
@@ -0,0 +1,100 @@
+---
+- name: install gitolite
+  apt:
+    name:
+    - git
+    - gitolite3
+
+- name: prepare storage volume for /srv/git
+  when: gitolite_storage is defined
+  vars:
+    storage_volume: "{{ gitolite_storage | combine({'dest': gitolite_base_path}) }}"
+  include_role:
+    name: "storage/{{ gitolite_storage.type }}/volume"
+
+- name: create gitolite instance user
+  loop: "{{ gitolite_instances | list }}"
+  user:
+    name: "git-{{ item }}"
+    home: "{{ gitolite_base_path }}/{{ item }}"
+    shell: /bin/sh
+    system: yes
+    state: present
+
+- name: make sure base dir is owned by gitolite user
+  loop: "{{ gitolite_instances | list }}"
+  file:
+    path: "{{ gitolite_base_path }}/{{ item }}"
+    mode: 0750
+    owner: "git-{{ item }}"
+    group: "git-{{ item }}"
+
+- name: deploy primary admin key
+  loop: "{{ gitolite_instances | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  copy:
+    content: "{{ item.value.primary_admin_key }}"
+    dest: "{{ gitolite_base_path }}/{{ item.key }}/primary-admin.pub"
+
+- name: run initial gitolite setup
+  loop: "{{ gitolite_instances | list }}"
+  become: yes
+  become_method: su
+  become_user: "git-{{ item }}"
+  args:
+    creates: "{{ gitolite_base_path }}/{{ item }}/.gitolite.rc"
+    chdir: "{{ gitolite_base_path }}/{{ item }}"
+  command: gitolite setup -pk "{{ gitolite_base_path }}/{{ item }}/primary-admin.pub"
+  register: gitolite_instance_initial_setup
+
+- name: remove testing repository
+  loop: "{{ gitolite_instance_initial_setup.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: item is changed
+  file:
+    path: "{{ gitolite_base_path }}/{{ item.item }}/repositories/testing.git"
+    state: absent
+
+- name: configure umask
+  loop: "{{ gitolite_instances | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  lineinfile:
+    path: "{{ gitolite_base_path }}/{{ item.key }}/.gitolite.rc"
+    backrefs: yes
+    regexp: "^(\\s*UMASK\\s*=>\\s*).*(,.*)$"
+    line: '\g<1>{{ item.value.umask | default("0077") }}\2'
+
+- name: configure GIT_CONFIG_KEYS to allow gitweb settings
+  loop: "{{ gitolite_instances | list }}"
+  lineinfile:
+    path: "{{ gitolite_base_path }}/{{ item }}/.gitolite.rc"
+    backrefs: yes
+    regexp: "^(\\s*GIT_CONFIG_KEYS\\s*=>\\s*').*('.*)$"
+    line: '\1cgit.*\2'
+
+- name: disable gitweb gitolite command
+  loop: "{{ gitolite_instances | list }}"
+  lineinfile:
+    path: "{{ gitolite_base_path }}/{{ item }}/.gitolite.rc"
+    backrefs: yes
+    regexp: "^(\\s*)('gitweb'.*)$"
+    line: '\1# \2'
+
+- name: enable daemon gitolite command
+  loop: "{{ gitolite_instances | list }}"
+  lineinfile:
+    path: "{{ gitolite_base_path }}/{{ item }}/.gitolite.rc"
+    backrefs: yes
+    regexp: "^(\\s*)#?\\s*('daemon'.*)$"
+    line: '\1\2'
+
+## TODO:
+# - name: enable http
+#   when: "'http' in gitolite_instance"
+#   include_role:
+#     name: gitolite/http
+
+## TODO: add systemd-timer for `git fsck`