git server via docker

Author: klevo

README.md

@@ -174,3 +174,24 @@ Run `go run ./cmd/qault -- list` (or any other subcommand) to exercise the CLI d
 ```sh
 go test ./...
 ```
+
+### HTTP git server for testing pushes
+
+Build and run a minimal HTTP git server with basic auth:
+
+```sh
+docker build -t qault/git-http ./server
+
+BCRYPT_PASSWORD=$(htpasswd -nbBC 12 alice 'plain-password' | cut -d: -f2)
+docker run -p 8080:8080 \
+  -e USERNAME=alice \
+  -e BCRYPT_PASSWORD="$BCRYPT_PASSWORD" \
+  -e REPO_NAME=qault-vault \
+  qault/git-http
+```
+
+Clone or push with your plain password; the server checks it against the bcrypt hash you supplied:
+
+```sh
+git clone http://alice:plain-password@localhost:8080/qault-vault.git
+```

server/Dockerfile

@@ -0,0 +1,68 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+	&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+		fcgiwrap \
+		git \
+		nginx-light \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /var/lib/git /run/fcgiwrap
+
+COPY --chmod=755 <<'EOF' /entrypoint.sh
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${USERNAME:?set USERNAME for HTTP basic auth}"
+: "${BCRYPT_PASSWORD:?set BCRYPT_PASSWORD containing a bcrypt hash}"
+: "${REPO_NAME:?set REPO_NAME for the bare repository (without .git)}"
+
+htpasswd_file=/etc/nginx/conf.d/htpasswd
+
+echo "${USERNAME}:${BCRYPT_PASSWORD}" > "${htpasswd_file}"
+chown www-data:www-data "${htpasswd_file}"
+chmod 640 "${htpasswd_file}"
+
+repo_path="/var/lib/git/${REPO_NAME}.git"
+if [ ! -d "${repo_path}" ]; then
+	git init --bare "${repo_path}"
+	chown -R www-data:www-data "${repo_path}"
+fi
+
+cat > /etc/nginx/sites-available/default <<'NGINXCONF'
+server {
+	listen 8080 default_server;
+	listen [::]:8080 default_server;
+	server_name _;
+
+	location / {
+		auth_basic "qault git server";
+		auth_basic_user_file /etc/nginx/conf.d/htpasswd;
+
+		include fastcgi_params;
+		fastcgi_param GIT_HTTP_EXPORT_ALL "";
+		fastcgi_param GIT_PROJECT_ROOT /var/lib/git;
+		fastcgi_param PATH_INFO $uri;
+		fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+		fastcgi_param REMOTE_USER $remote_user;
+		fastcgi_pass unix:{{SOCKET_PATH}};
+	}
+}
+NGINXCONF
+
+mkdir -p /run/fcgiwrap
+chown www-data:www-data /run/fcgiwrap
+
+socket_path="/run/fcgiwrap/fcgiwrap.sock"
+sed -i "s|{{SOCKET_PATH}}|${socket_path}|g" /etc/nginx/sites-available/default
+
+su -s /bin/sh -c "fcgiwrap -s unix:${socket_path}" www-data &
+
+trap "kill 0" EXIT
+
+exec nginx -g 'daemon off;'
+EOF
+
+EXPOSE 8080
+
+ENTRYPOINT ["/entrypoint.sh"]