diff options
| author | Arseney300 <Arseney300@gmail.com> | 2026-02-20 04:56:52 +0700 |
|---|---|---|
| committer | Arseney300 <Arseney300@gmail.com> | 2026-02-20 04:56:52 +0700 |
| commit | b68790d86a40294ba035b93e40b29f1a071359a1 (patch) | |
| tree | 8eccd2412be8c287bf5de1d835955b44e8515cab /nginx | |
| parent | ee7d961c638c3baa0ba12b0451fe5104fecc95a9 (diff) | |
Add cgit web interface to git-server stack
Adds a lightweight cgit container (Alpine + fcgiwrap + nginx) that
auto-discovers bare repos via scan-path and serves them read-only.
Accessible at both cgit.swave.lol and swave.lol/cgit through the
main nginx reverse proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Diffstat (limited to 'nginx')
| -rw-r--r-- | nginx/nginx.conf | 51 | ||||
| -rw-r--r-- | nginx/run_certbot.sh | 3 |
2 files changed, 52 insertions, 2 deletions
diff --git a/nginx/nginx.conf b/nginx/nginx.conf index b62b458..dd852d2 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -4,7 +4,7 @@ server { listen 80; listen [::]:80; - server_name swave.lol blog.swave.lol jenkins.swave.lol; + server_name swave.lol blog.swave.lol jenkins.swave.lol cgit.swave.lol; location / { rewrite ^ https://$host$request_uri? permanent; @@ -48,6 +48,15 @@ server { charset utf-8; + # Cgit via path prefix on main domain + location /cgit { + proxy_pass http://cgit:80/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # Jenkins via path prefix on main domain location /jenkins { proxy_pass http://jenkins:8080/jenkins; @@ -106,3 +115,43 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } } + +# Cgit — cgit.swave.lol +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name cgit.swave.lol; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + charset utf-8; + + location / { + proxy_pass http://cgit:80; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh index 3859d19..d265cce 100644 --- a/nginx/run_certbot.sh +++ b/nginx/run_certbot.sh @@ -20,4 +20,5 @@ docker run -it --rm \ --webroot-path=/data/letsencrypt \ -d $domain \ -d blog.$domain \ - -d jenkins.$domain + -d jenkins.$domain \ + -d cgit.$domain |