From 0ac4c97369e60523c2bf95c3eaa7777f7703d2e8 Mon Sep 17 00:00:00 2001
From: Monzero Build System <builds@monzero.org>
Date: Sat, 15 Aug 2026 21:47:24 +0100
Subject: Deploy read-only Monzero source service

---
 deploy/code-host/nginx-code.monzero.org.conf | 36 ++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 deploy/code-host/nginx-code.monzero.org.conf

(limited to 'deploy/code-host/nginx-code.monzero.org.conf')

diff --git a/deploy/code-host/nginx-code.monzero.org.conf b/deploy/code-host/nginx-code.monzero.org.conf
new file mode 100644
index 000000000..5ca7d43a6
--- /dev/null
+++ b/deploy/code-host/nginx-code.monzero.org.conf
@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name code.monzero.org;
+
+    client_max_body_size 1m;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy no-referrer always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    location /assets/ {
+        alias /usr/share/cgit/;
+        expires 1d;
+    }
+
+    # Read-only smart HTTP cloning. Deliberately no git-receive-pack route.
+    location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        fastcgi_param GIT_PROJECT_ROOT /srv/git;
+        fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        fastcgi_param PATH_INFO /$1/$2;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    location / {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+}
+
-- 
cgit v1.2.3