ctucx.git: ansible-configs

roles/cgit: add support for smart http-cloning

diff --git a/roles/cgit/tasks/install.yml b/roles/cgit/tasks/install.yml
@@ -5,6 +5,7 @@
     name:
       - cgit
       - git
+      - git-daemon
       - spawn-fcgi
       - fcgiwrap
       - py3-markdown

diff --git a/roles/cgit/templates/nginx-vhost.conf.j2 b/roles/cgit/templates/nginx-vhost.conf.j2
@@ -34,6 +34,21 @@ server {
 	server_name {{ services.cgit.nginx.domain }};
 
 	root /usr/share/webapps/cgit;
+
+	location ~ "^/[a-zA-Z0-9._-]+/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))$" {
+		if ($query_string = service=git-receive-pack) {
+			return 403;
+		}
+
+		client_max_body_size 0;
+
+		include fastcgi_params;
+		fastcgi_pass 127.0.0.1:8001;
+		fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend;
+		fastcgi_param GIT_PROJECT_ROOT /var/lib/git/repositories;
+		fastcgi_param PATH_INFO $fastcgi_script_name;
+	}
+
 	try_files $uri @cgit;
 
 	location @cgit {