From 7da08cb47fd07d4220f459475bb8bce405512397 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 28 Aug 2018 22:05:45 +0200
Subject: krebs git: allow git user to rwx cgit cache-root

---
 krebs/3modules/git.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'krebs/3modules/git.nix')

diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 89726fd7..8a923efd 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -348,6 +348,10 @@ let
     users.users.${cfg.user.name} = {
       inherit (cfg.user) home name uid;
       description = "Git repository hosting user";
+      extraGroups = [
+        # To allow running cgit-clear-cache via hooks.
+        cfg.cgit.fcgiwrap.group.name
+      ];
       shell = "/bin/sh";
       openssh.authorizedKeys.keys =
         unique
@@ -407,7 +411,8 @@ let
     ];
 
     system.activationScripts.cgit = ''
-      mkdir -m 0700 -p ${cfg.cgit.settings.cache-root}
+      mkdir -m 0770 -p ${cfg.cgit.settings.cache-root}
+      chmod 0770 ${cfg.cgit.settings.cache-root}
       chown ${toString cfg.cgit.fcgiwrap.user.uid}:${toString cfg.cgit.fcgiwrap.group.gid} ${cfg.cgit.settings.cache-root}
     '';
 
-- 
cgit v1.2.3