Minimal git Infrastructure

Goal: To run your own minimal git infrastructure exclusively for your shell users (sorry no guest, no wiki, no issue tracker, and send patches via email plz or GTFO), making use of ancient ACL magic, and providing a web interface with  for public repos browsing and anonymous read-only clone/pull. In this example we use LURK's domain name and server setup as an example.

Installs
apt install libgit2-dev acl cd /usr/src git clone git://git.codemadness.org/stagit cd stagit make && make install
 * Install  headers and ACL tools, on Debian:
 * Compile and install, a static   page generator:
 * 1) Optional: edit stagit-index.c to customize some settings like the site header, etc.

configs
We need two directories, one for serving the public static files, and one for keeping the bare  repositories.

mkdir -p /var/www/git.lurk.org/repos cp /usr/src/stagit/style.css /var/www/git.lurk.org wget https://things.bleu255.com/runyourown/images/d/d5/Runyourown.png -O /var/www/git.lurk.org/logo.png addgroup gitusers setfacl -Rm g:gitusers:rwX /var/www/git.lurk.org/ setfacl -d -Rm g:gitusers:rwX /var/www/git.lurk.org/ adduser alice gitusers adduser bob gitusers server { listen 443;
 * create these directories for your repos and for :
 * Get a style
 * 1) Optional: further stylify style.css
 * Get a logo
 * Copy the following handy shell scripts and put them in :
 * : https://git.bleu255.com/stagit/file/scripts/new_repos.sh.html
 * : https://git.bleu255.com/stagit/file/scripts/reset_all.sh.html
 * : https://git.bleu255.com/stagit/file/scripts/update_all.sh.html
 * : https://git.bleu255.com/stagit/file/scripts/update_single.sh.html
 * dont' forget to  them :)
 * Edit,  , and   to update hardcoded paths and others!
 * Create a group for the users who will be allowed to create and contribute to any of the hosted repos:
 * Give this group the permissions to modify each others files in the git folders:
 * Add the local users who should have access to full read-write access to the  group:
 * 1) etc...
 * Create a new nginx site config for the static website in :

server_name git.lurk.org;

root /var/www/git.lurk.org/; autoindex on;

access_log /var/log/nginx/git.lurk.org-access.log; error_log /var/log/nginx/git.lurk.org-error.log; } ln -s /etc/nginx/sites-available/git.lurk.org /etc/nginx/sites-enabled/ service nginx reload
 * Enable it and reload nginx:

DONE! Now you should make some repos :)

Create a new repos on the git server
This can be done by any user in the group, no need to be root: cd /var/www/git.lurk.org ./new_repos.sh name-of-the-repos "oneline about the repos"

Create local repos and set the git server as origin
On your machine and after the repos on the git server was created: mkdir name-of-the-repos cd name-of-the-repos git init git remote add origin server-name:/var/www/git.lurk.org/repos/name-of-the-repos.git git push --set-upstream origin master
 * 1) now add and git commit some files

Clone existing repos to contribute
git clone server-name:/var/www/git.lurk.org/repos/name-of-the-repos.git

Post-receive Hook Goodness
Say that one of your repos is a static website, and that you would like to have this very website updated live as you push to your repos and served on your server from. You can tweak the default stagit related post-receive git hook to do all this.

SKIPPED: From this point we assume that you have configured your HTTP server to serve www.lurk.org from  and that of course this path exits.

setfacl -Rm g:gitusers:rwX /var/www/www.lurk.org/ setfacl -d -Rm g:gitusers:rwX /var/www/www.lurk.org/
 * As root:

As any user from the  you can do the following: cd /var/www/www.lurk.org/ git clone /var/www/git.lurk.org/repos/www.lurk.org.git. cd /var/www/git.lurk.org/repos/www.lurk.org.git/hooks rm post-receive cp ../../../update_single.sh post-receive unset GIT_DIR git -C /var/www/www.lurk.org pull printf "done updating website\n"
 * Clone the repos
 * Go to your repos' hook folder
 * Delete the current post-receive hook (currently a symlink to )
 * Copy the same script again
 * Edit  and append the following:
 * 1) HERE IS THE EXTRA BIT!

Allowing a Limited User to Push to the Repos
The both great and crappy thing about this setup is that it makes use of the OS level for user management, so if you want to add another committer, you need to give them a shell access to your server. Obviously you're better off with something like gitea if you intend to allow many users to join and contribute to your awesome software, as it will be a PITA to  new people all the time.

However, if it's something exceptional and it's convenient to give someone read-write access to your repos without a full shell access you can do it like this:

adduser somebody chsh -s /usr/bin/git-shell somebody

Note: don't consider this as a fail-proof security thing, if you don't trust the user, maybe you should not give them a shell in the first place.