Serve only listed mirrors and report a failed default-branch lookupops/git-mirrors

- git-http-backend no longer exports every directory under the mirror
  root: GIT_HTTP_EXPORT_ALL is gone, git-mirror marks each listed mirror
  with git-daemon-export-ok, and a mirror taken off the list loses the
  mark and is deleted on the next run. Tried live: an unlisted bare
  repository answered 404 and was removed by the next run.
- git-mirror checks git ls-remote before it reads the default branch
  and fails the run when the lookup fails.
- The README explains the /usr/bin spelling of the fcgiwrap label (an
  equivalence of /usr/sbin), the stock label of /srv/*/www, and where
  the DNS record is kept.

1 files changed, 1 insertions, 1 deletions

diff --git a/ops/git/nginx/git.conf b/ops/git/nginx/git.conf
index c11dce4..71c5b75 100644
--- a/ops/git/nginx/git.conf
+++ b/ops/git/nginx/git.conf
@@ -80,7 +80,7 @@ server {
         include fastcgi_params;
         fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend;
         fastcgi_param GIT_PROJECT_ROOT /srv/git/mirrors;
-        fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        # No GIT_HTTP_EXPORT_ALL: only mirrors git-mirror marks with git-daemon-export-ok are served.
         fastcgi_param PATH_INFO /$git_repo.git/$git_path;
         fastcgi_param REMOTE_USER "";
         # The mirrors belong to gitmirror and are read as cgit; only this backend trusts them.