Deploy read-only Monzero source service

3 files changed, 73 insertions, 0 deletions

diff --git a/deploy/code-host/README.md b/deploy/code-host/README.md
new file mode 100644
index 000000000..a6a2827d9
--- /dev/null
+++ b/deploy/code-host/README.md
@@ -0,0 +1,16 @@
+# code.monzero.org deployment
+
+This configuration publishes read-only source browsing and Git clones from
+`/srv/git` on the Monzero VPS. Administrative pushes remain restricted to SSH.
+It does not change the Monzero daemon service or ports.
+
+The deployed repositories are mirrors of the local recovery remotes:
+
+- `monzero-core.git`
+- `monzero-gui.git`
+- `monzero-gitian-sigs.git`
+
+Nginx exposes only `git-upload-pack`; it intentionally has no
+`git-receive-pack` route. After deployment, Certbot upgrades the virtual host
+to HTTPS and UFW admits ports 80 and 443.
+
diff --git a/deploy/code-host/cgitrc b/deploy/code-host/cgitrc
new file mode 100644
index 000000000..e7680f15f
--- /dev/null
+++ b/deploy/code-host/cgitrc
@@ -0,0 +1,21 @@
+css=/assets/cgit.css
+logo=/assets/cgit.png
+favicon=/assets/favicon.ico
+root-title=Monzero Source
+root-desc=Public source code and reproducible-build assertions for Monzero
+virtual-root=/
+clone-prefix=https://code.monzero.org
+enable-http-clone=1
+enable-index-owner=0
+enable-index-links=1
+enable-log-filecount=1
+enable-log-linecount=1
+enable-commit-graph=1
+max-repo-count=20
+snapshots=tar.gz tar.xz zip
+readme=:README.md
+readme=:README
+remove-suffix=0
+section-from-path=0
+scan-path=/srv/git
+
diff --git a/deploy/code-host/nginx-code.monzero.org.conf b/deploy/code-host/nginx-code.monzero.org.conf
new file mode 100644
index 000000000..5ca7d43a6
--- /dev/null
+++ b/deploy/code-host/nginx-code.monzero.org.conf
@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name code.monzero.org;
+
+    client_max_body_size 1m;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy no-referrer always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    location /assets/ {
+        alias /usr/share/cgit/;
+        expires 1d;
+    }
+
+    # Read-only smart HTTP cloning. Deliberately no git-receive-pack route.
+    location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        fastcgi_param GIT_PROJECT_ROOT /srv/git;
+        fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        fastcgi_param PATH_INFO /$1/$2;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    location / {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+}
+