diff --git a/files/git-daemon.service b/files/git-daemon.service new file mode 100644 index 0000000..2622fd9 --- /dev/null +++ b/files/git-daemon.service @@ -0,0 +1,9 @@ +[Unit] +Description=Git Repositories Server Daemon +Documentation=man:git-daemon(1) +Wants=git-daemon.socket + +[Service] +User=nobody +ExecStart=-/usr/libexec/git-core/git-daemon --base-path=/var/lib/git --export-all --syslog --inetd --verbose /var/lib/git +StandardInput=socket diff --git a/manifests/init.pp b/manifests/init.pp index 13dd288..385fa16 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -91,10 +91,6 @@ class cgit( include ::httpd - if ($::osfamily == 'RedHat') { - include ::cgit::selinux - } - package { [ 'cgit', 'git-daemon', @@ -195,18 +191,44 @@ class cgit( require => File[$cgitdir], } - file { '/etc/init.d/git-daemon': - ensure => present, - owner => 'root', - group => 'root', - mode => '0755', - content => template('cgit/git-daemon.init.erb'), + if ($::osfamily == 'RedHat' and $::operatingsystemmajrelease >= '7') { + $git_daemon_service_name = 'git-daemon.socket' + file { '/usr/lib/systemd/system/git-daemon.socket': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + content => template('cgit/git-daemon.socket.erb'), + } + file { 'git-daemon-init-script': + ensure => present, + path => '/usr/lib/systemd/system/git-daemon@.service', + owner => 'root', + group => 'root', + mode => '0644', + source => 'puppet:///modules/cgit/git-daemon.service', + subscribe => File['/usr/lib/systemd/system/git-daemon.socket'], + } + } else { + $git_daemon_service_name = 'git-daemon' + file { 'git-daemon-init-script': + ensure => present, + path => '/etc/init.d/git-daemon', + owner => 'root', + group => 'root', + mode => '0755', + content => template('cgit/git-daemon.init.erb'), + } } - service { 'git-daemon': + service { $git_daemon_service_name: ensure => running, enable => true, - subscribe => File['/etc/init.d/git-daemon'], + subscribe => File['git-daemon-init-script'], + } + + if ($::osfamily == 'RedHat') { + include ::cgit::selinux } if $ssl_cert_file_contents != undef { diff --git a/manifests/selinux.pp b/manifests/selinux.pp index 0a5d4eb..95e5029 100644 --- a/manifests/selinux.pp +++ b/manifests/selinux.pp @@ -45,5 +45,15 @@ class cgit::selinux { subscribe => File['/etc/httpd/conf.d/ssl.conf'], refreshonly => true, } + + exec { 'cgit_allow_git_daemon_port': + # If we cannot add the rule modify the existing rule. + onlyif => "bash -c \'! semanage port -a -t git_port_t -p tcp ${::cgit::daemon_port}\'", + command => "semanage port -m -t git_port_t -p tcp ${::cgit::daemon_port}", + path => '/bin:/usr/sbin', + before => Service[$::cgit::git_daemon_service_name], + subscribe => File['git-daemon-init-script'], + refreshonly => true, + } } diff --git a/templates/git-daemon.socket.erb b/templates/git-daemon.socket.erb new file mode 100644 index 0000000..626b284 --- /dev/null +++ b/templates/git-daemon.socket.erb @@ -0,0 +1,9 @@ +[Unit] +Description=Git Activation Socket + +[Socket] +ListenStream=<%= scope.lookupvar("cgit::daemon_port") %> +Accept=true + +[Install] +WantedBy=sockets.target