Deploy read-only Monzero source service

1 files changed, 36 insertions, 0 deletions

diff --git a/deploy/code-host/nginx-code.monzero.org.conf b/deploy/code-host/nginx-code.monzero.org.conf
new file mode 100644
index 000000000..5ca7d43a6
--- /dev/null
+++ b/deploy/code-host/nginx-code.monzero.org.conf
@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name code.monzero.org;
+
+    client_max_body_size 1m;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy no-referrer always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    location /assets/ {
+        alias /usr/share/cgit/;
+        expires 1d;
+    }
+
+    # Read-only smart HTTP cloning. Deliberately no git-receive-pack route.
+    location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        fastcgi_param GIT_PROJECT_ROOT /srv/git;
+        fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        fastcgi_param PATH_INFO /$1/$2;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    location / {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+}
+