Merge branch 'main' into content/catalog-without-talacontent/catalog-without-tala

5 files changed, 109 insertions, 0 deletions

diff --git a/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf b/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf
new file mode 100644
index 0000000..5f5b94f
--- /dev/null
+++ b/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf
@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# cgit and git-http-backend read the mirrors and write only the cache of cgit; they reach no
+# network and keep no rights of their own.
+#
+# fcgiwrap runs in httpd_t (/usr/bin/fcgiwrap is httpd_exec_t), so Nginx may connect to it, and
+# cgit and git-http-backend move into git_script_t; the module in ../selinux allows that move under
+# NoNewPrivileges.
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/cache/cgit
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+CapabilityBoundingSet=
+AmbientCapabilities=
+UMask=0077
diff --git a/ops/git/systemd/fcgiwrap@cgit.service.d/processes.conf b/ops/git/systemd/fcgiwrap@cgit.service.d/processes.conf
new file mode 100644
index 0000000..b818abb
--- /dev/null
+++ b/ops/git/systemd/fcgiwrap@cgit.service.d/processes.conf
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# Four workers, so a long clone does not hold up the pages. Without -f, what cgit and
+# git-http-backend write to stderr goes to the journal, not to the visitor.
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/fcgiwrap -c 4
diff --git a/ops/git/systemd/fcgiwrap@cgit.socket.d/nginx.conf b/ops/git/systemd/fcgiwrap@cgit.socket.d/nginx.conf
new file mode 100644
index 0000000..51ce6de
--- /dev/null
+++ b/ops/git/systemd/fcgiwrap@cgit.socket.d/nginx.conf
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# Only Nginx reaches cgit and git-http-backend: the socket belongs to cgit and the group nginx.
+[Socket]
+SocketGroup=nginx
+SocketMode=0660
diff --git a/ops/git/systemd/git-mirror.service b/ops/git/systemd/git-mirror.service
new file mode 100644
index 0000000..1e07bd0
--- /dev/null
+++ b/ops/git/systemd/git-mirror.service
@@ -0,0 +1,44 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+[Unit]
+Description=Mirror the public repositories of Progmasoft from GitHub for git.progmasoft.com
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=gitmirror
+Group=gitmirror
+ExecStart=/usr/local/libexec/git-mirror
+Nice=10
+IOSchedulingClass=idle
+TimeoutStartSec=15min
+
+# It reads public repositories over HTTPS and writes only the mirrors.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/srv/git/mirrors
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+CapabilityBoundingSet=
+AmbientCapabilities=
+UMask=0022
diff --git a/ops/git/systemd/git-mirror.timer b/ops/git/systemd/git-mirror.timer
new file mode 100644
index 0000000..a0b20a5
--- /dev/null
+++ b/ops/git/systemd/git-mirror.timer
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+[Unit]
+Description=Mirror the repositories of git.progmasoft.com every ten minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=10min
+RandomizedDelaySec=30s
+
+[Install]
+WantedBy=timers.target