diff options
| -rw-r--r-- | deploy/code-host/README.md | 16 | ||||
| -rw-r--r-- | deploy/code-host/cgitrc | 21 | ||||
| -rw-r--r-- | deploy/code-host/nginx-code.monzero.org.conf | 36 | ||||
| -rw-r--r-- | docs/MONZERO_PUBLIC_REPOSITORIES.md | 28 |
4 files changed, 95 insertions, 6 deletions
diff --git a/deploy/code-host/README.md b/deploy/code-host/README.md new file mode 100644 index 000000000..a6a2827d9 --- /dev/null +++ b/deploy/code-host/README.md @@ -0,0 +1,16 @@ +# code.monzero.org deployment + +This configuration publishes read-only source browsing and Git clones from +`/srv/git` on the Monzero VPS. Administrative pushes remain restricted to SSH. +It does not change the Monzero daemon service or ports. + +The deployed repositories are mirrors of the local recovery remotes: + +- `monzero-core.git` +- `monzero-gui.git` +- `monzero-gitian-sigs.git` + +Nginx exposes only `git-upload-pack`; it intentionally has no +`git-receive-pack` route. After deployment, Certbot upgrades the virtual host +to HTTPS and UFW admits ports 80 and 443. + diff --git a/deploy/code-host/cgitrc b/deploy/code-host/cgitrc new file mode 100644 index 000000000..e7680f15f --- /dev/null +++ b/deploy/code-host/cgitrc @@ -0,0 +1,21 @@ +css=/assets/cgit.css +logo=/assets/cgit.png +favicon=/assets/favicon.ico +root-title=Monzero Source +root-desc=Public source code and reproducible-build assertions for Monzero +virtual-root=/ +clone-prefix=https://code.monzero.org +enable-http-clone=1 +enable-index-owner=0 +enable-index-links=1 +enable-log-filecount=1 +enable-log-linecount=1 +enable-commit-graph=1 +max-repo-count=20 +snapshots=tar.gz tar.xz zip +readme=:README.md +readme=:README +remove-suffix=0 +section-from-path=0 +scan-path=/srv/git + diff --git a/deploy/code-host/nginx-code.monzero.org.conf b/deploy/code-host/nginx-code.monzero.org.conf new file mode 100644 index 000000000..5ca7d43a6 --- /dev/null +++ b/deploy/code-host/nginx-code.monzero.org.conf @@ -0,0 +1,36 @@ +server { + listen 80; + listen [::]:80; + server_name code.monzero.org; + + client_max_body_size 1m; + + add_header X-Content-Type-Options nosniff always; + add_header X-Frame-Options SAMEORIGIN always; + add_header Referrer-Policy no-referrer always; + add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + + location /assets/ { + alias /usr/share/cgit/; + expires 1d; + } + + # Read-only smart HTTP cloning. Deliberately no git-receive-pack route. + location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend; + fastcgi_param GIT_PROJECT_ROOT /srv/git; + fastcgi_param GIT_HTTP_EXPORT_ALL ""; + fastcgi_param PATH_INFO /$1/$2; + fastcgi_pass unix:/run/fcgiwrap.socket; + } + + location / { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_pass unix:/run/fcgiwrap.socket; + } +} + diff --git a/docs/MONZERO_PUBLIC_REPOSITORIES.md b/docs/MONZERO_PUBLIC_REPOSITORIES.md index 4cc2a5f76..296eebb1b 100644 --- a/docs/MONZERO_PUBLIC_REPOSITORIES.md +++ b/docs/MONZERO_PUBLIC_REPOSITORIES.md @@ -1,6 +1,7 @@ # Monzero public repository setup -Three Monzero-owned repositories are required before public reproducible builds: +Three Monzero-owned, read-only public repositories are deployed at +`https://code.monzero.org`: | Repository | Purpose | Initial local source | | --- | --- | --- | @@ -8,6 +9,17 @@ Three Monzero-owned repositories are required before public reproducible builds: | `monzero-gui` | Desktop GUI | `/home/pinhead/Projects/Monzero-Fork-backups/git-remotes/monzero-gui.git` | | `monzero-gitian-sigs` | Independent reproducible-build assertions and builder public keys | `/home/pinhead/Projects/Monzero-Fork-backups/git-remotes/monzero-gitian-sigs.git` | +Public clone URLs: + +- `https://code.monzero.org/monzero-core.git` +- `https://code.monzero.org/monzero-gui.git` +- `https://code.monzero.org/monzero-gitian-sigs.git` + +The VPS publishes source browsing through Cgit and cloning through Git smart +HTTP. HTTP redirects to HTTPS, certificate renewal is enabled and tested, and +HTTP write routes are deliberately absent. The repositories retain local +backup `origin` remotes and use `public` for this read-only deployment. + Do not publish these under an individual contributor's account if a Monzero organization is intended. Create the organization first, enable multifactor authentication for owners, and retain at least two organization owners. @@ -26,9 +38,14 @@ Protect `main` in all three repositories: Core release tags should be annotated and signed. Do not allow an automated workflow to possess a human builder's private Gitian signing key. -## Publishing the prepared repositories +## Publishing updates -After creating empty public repositories, replace the example URLs and push: +The public service is intentionally read-only. Commit and push to each local +backup `origin`, then deploy its bare mirror to `/srv/git` over the restricted +administrator SSH connection. Do not expose `git-receive-pack` through Nginx. + +The following is retained as the future migration pattern if the projects move +to a hosted forge with protected write access: ```bash git remote set-url origin https://HOST/MONZERO_ORG/monzero-core.git @@ -63,12 +80,11 @@ artifacts before those artifacts are marked verified. The Gitian command requires an explicit source repository: ```bash -MONZERO_GITIAN_SIGS_URL=https://HOST/MONZERO_ORG/monzero-gitian-sigs.git \ +MONZERO_GITIAN_SIGS_URL=https://code.monzero.org/monzero-gitian-sigs.git \ contrib/gitian/gitian-build.py --setup --docker \ - --url https://HOST/MONZERO_ORG/monzero-core.git BUILDER RELEASE + --url https://code.monzero.org/monzero-core.git BUILDER RELEASE ``` Asset/NFT consensus functionality remains inactive throughout repository and release setup. Its activation requires the separate review and public-testnet gates in `MONZERO_PHASE0_STABILIZATION.md`. - |