-tokio = { version = "1.44.2", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "signal"] }

-- Git fetch and push use SSH public-key authentication through `gilti-ssh`.

-- cgit is anonymous and read-only; every repository is publicly visible.

-- Smart HTTP, password authentication, shells, forwarding, and tunnels are

- disabled; cgit filters are not supported.

-- `GILTI_CGIT_CACHE` (default: `5`, maximum: `3600` seconds).

-static void querystring_cb(const char *name, const char *value)

- if (!value)

- value = "";

-

- if (!strcmp(name,"r")) {

- ctx.qry.repo = xstrdup(value);

- ctx.repo = cgit_get_repoinfo(value);

- } else if (!strcmp(name, "p")) {

- ctx.qry.page = xstrdup(value);

- } else if (!strcmp(name, "url")) {

- if (*value == '/')

- value++;

- ctx.qry.url = xstrdup(value);

- cgit_parse_url(value);

- } else if (!strcmp(name, "qt")) {

- ctx.qry.grep = xstrdup(value);

- } else if (!strcmp(name, "q")) {

- ctx.qry.search = xstrdup(value);

- } else if (!strcmp(name, "h")) {

- ctx.qry.head = xstrdup(value);

- } else if (!strcmp(name, "id")) {

- ctx.qry.oid = xstrdup(value);

- ctx.qry.has_oid = 1;

- } else if (!strcmp(name, "id2")) {

- ctx.qry.oid2 = xstrdup(value);

- ctx.qry.has_oid = 1;

- } else if (!strcmp(name, "ofs")) {

- ctx.qry.ofs = atoi(value);

- } else if (!strcmp(name, "path")) {

- ctx.qry.path = trim_end(value, '/');

- } else if (!strcmp(name, "name")) {

- ctx.qry.name = xstrdup(value);

- } else if (!strcmp(name, "s")) {

- ctx.qry.sort = xstrdup(value);

- } else if (!strcmp(name, "showmsg")) {

- ctx.qry.showmsg = atoi(value);

- } else if (!strcmp(name, "period")) {

- ctx.qry.period = xstrdup(value);

- } else if (!strcmp(name, "dt")) {

- ctx.qry.difftype = atoi(value);

- ctx.qry.has_difftype = 1;

- } else if (!strcmp(name, "ss")) {

- /* No longer generated, but there may be links out there. */

- ctx.qry.difftype = atoi(value) ? DIFF_SSDIFF : DIFF_UNIFIED;

- ctx.qry.has_difftype = 1;

- } else if (!strcmp(name, "all")) {

- ctx.qry.show_all = atoi(value);

- } else if (!strcmp(name, "context")) {

- ctx.qry.context = atoi(value);

- } else if (!strcmp(name, "ignorews")) {

- ctx.qry.ignorews = atoi(value);

- } else if (!strcmp(name, "follow")) {

- ctx.qry.follow = atoi(value);

- if (ctx.env.query_string)

- ctx.qry.raw = xstrdup(ctx.env.query_string);

-}

-

-struct refmatch {

- char *req_ref;

- char *first_ref;

- int match;

-};

-

-static int find_current_ref(const struct reference *ref, void *cb_data)

-{

- struct refmatch *info;

-

- info = (struct refmatch *)cb_data;

- if (!strcmp(ref->name, info->req_ref))

- info->match = 1;

- if (!info->first_ref)

- info->first_ref = xstrdup(ref->name);

- return info->match;

-static void free_refmatch_inner(struct refmatch *info)

- if (info->first_ref)

- free(info->first_ref);

-}

-

-static char *find_default_branch(struct cgit_repo *repo)

-{

- struct refmatch info;

- char *ref;

-

- info.req_ref = repo->defbranch;

- info.first_ref = NULL;

- info.match = 0;

- refs_for_each_branch_ref(get_main_ref_store(the_repository),

- find_current_ref, &info);

- if (info.match)

- ref = info.req_ref;

- else

- ref = info.first_ref;

- if (ref)

- ref = xstrdup(ref);

- free_refmatch_inner(&info);

-

- return ref;

- const char *ref, *refname;

- if (!ref || !skip_prefix(ref, "refs/heads/", &refname))

- return "master";

- return xstrdup(refname);

- html_url_path(url);

- if (!ctx.qry.head) {

- ctx.qry.nohead = 1;

- ctx.qry.head = find_default_branch(ctx.repo);

- }

- if (!ctx.qry.head) {

- if (!strcmp(ctx.qry.page, "summary")) {

- html("<table class='list'><tr class='nohover'><td>&nbsp;</td></tr><tr class='nohover'><th class='left'>Clone</th></tr>\n");

- cgit_prepare_repo_env(ctx.repo);

- cgit_add_clone_urls(print_no_repo_clone_urls);

- html("</table>\n");

- }

-

- if (repo_get_oid(the_repository, ctx.qry.head, &oid)) {

- char *old_head = ctx.qry.head;

- ctx.qry.head = xstrdup(ctx.repo->defbranch);

- cgit_print_error_page(404, "Not found",

- "Invalid branch: %s", old_head);

- free(old_head);

- return 1;

- }

- const char *path;

-

- ctx.repo = NULL;

- http_parse_querystring(ctx.qry.raw, querystring_cb);

-

- /* If no url parameter is specified on the querystring, use PATH_INFO

- * as url. This allows cgit to work with virtual urls without the need

- * for rewriterules in the webserver.

- */

- path = ctx.env.path_info;

- if (!ctx.qry.url && path) {

- if (path[0] == '/')

- path++;

- ctx.qry.url = xstrdup(path);

- if (ctx.qry.raw) {

- char *newqry = fmtalloc("%s?%s", path, ctx.qry.raw);

- free(ctx.qry.raw);

- ctx.qry.raw = newqry;

- } else

- ctx.qry.raw = xstrdup(ctx.qry.url);

- cgit_parse_url(ctx.qry.url);

- }

-

- char *raw;

- char *name;

- int nohead;

-extern void cgit_parse_url(const char *url);

-

- if (ctx.repo) {

- size_t path_info_len = ctx.env.path_info ? strlen(ctx.env.path_info) : 0;

- if (!ctx.qry.path &&

- ctx.qry.url[strlen(ctx.qry.url) - 1] != '/' &&

- (!path_info_len || ctx.env.path_info[path_info_len - 1] != '/')) {

- char *currenturl = cgit_currenturl();

- char *redirect = fmtalloc("%s/", currenturl);

- cgit_redirect(redirect, true);

- free(currenturl);

- free(redirect);

- } else if (ctx.repo->readme.nr)

- cgit_print_repo_readme(ctx.qry.path);

- else if (ctx.repo->homepage)

- cgit_redirect(ctx.repo->homepage, false);

- else {

- char *currenturl = cgit_currenturl();

- char *redirect = fmtalloc("%s../", currenturl);

- cgit_redirect(redirect, false);

- free(currenturl);

- free(redirect);

- }

- } else

- cgit_print_snapshot(ctx.qry.head, ctx.qry.oid, ctx.qry.path,

- ctx.qry.nohead);

-

-void http_parse_querystring(const char *txt, void (*fn)(const char *name, const char *value))

-{

- const char *t = txt;

-

- while (t && *t) {

- char *name = url_decode_parameter_name(&t);

- if (*name) {

- char *value = url_decode_parameter_value(&t);

- fn(name, value);

- free(value);

- }

- free(name);

- }

-}

-extern void http_parse_querystring(const char *txt, void (*fn)(const char *name, const char *value));

-/*

- * url syntax: [repo ['/' cmd [ '/' path]]]

- * repo: any valid repo url, may contain '/'

- * cmd: log | commit | diff | tree | view | blob | snapshot

- * path: any valid path, may contain '/'

- *

- */

-void cgit_parse_url(const char *url)

-{

- char *c, *cmd, *p, *buf;

- struct cgit_repo *repo;

-

- if (!url || url[0] == '\0')

- return;

-

- ctx.qry.page = NULL;

- ctx.repo = cgit_get_repoinfo(url);

- if (ctx.repo) {

- ctx.qry.repo = ctx.repo->url;

- return;

- }

-

- buf = xstrdup(url);

- cmd = NULL;

- c = strchr(buf, '/');

- while (c) {

- c[0] = '\0';

- repo = cgit_get_repoinfo(buf);

- if (repo) {

- ctx.repo = repo;

- cmd = c;

- }

- c[0] = '/';

- c = strchr(c + 1, '/');

- }

-

- if (ctx.repo) {

- ctx.qry.repo = ctx.repo->url;

- p = strchr(cmd + 1, '/');

- if (p) {

- p[0] = '\0';

- if (p[1])

- ctx.qry.path = trim_end(p + 1, '/');

- }

- if (cmd[1])

- ctx.qry.page = xstrdup(cmd + 1);

- }

- free(buf);

-}

-

- char delim = '&';

- pageurl = cgit_pageurl(ctx.repo->url, "commit", NULL);

- if (ctx.cfg.virtual_root)

- delim = '?';

- html_attrf("%cid=%s", delim, hex);

- return 1;

- strbuf_addf(&path, "%s/refs/heads/%s", repo->path,

- repo->defbranch ? repo->defbranch : "master");

- if (stat(path.buf, &s) == 0) {

- *mtime = s.st_mtime;

- r->mtime = *mtime;

- goto end;

-static int is_in_url(struct cgit_repo *repo)

-{

- if (!ctx.qry.url)

- return 1;

- if (repo->url && starts_with(repo->url, ctx.qry.url))

- return 1;

- return 0;

-}

-

- if (!(is_match(repo) && is_in_url(repo)))

- return 0;

- return 1;

- if (isalnum(*p) || strchr("!$()*,./:;@-[]_~+&", *p))

- const char *delimiter = "?";

- if (ctx.cfg.virtual_root) {

- url_path(&url, ctx.cfg.virtual_root);

- url_path(&url, repo->url);

- if (repo->url[strlen(repo->url) - 1] != '/')

- strbuf_addch(&url, '/');

- if (page) {

- url_path(&url, page);

- strbuf_addch(&url, '/');

- }

- } else {

- url_path(&url, ctx.cfg.script_name);

- strbuf_addstr(&url, "?url=");

- url_arg(&url, repo->url);

- if (repo->url[strlen(repo->url) - 1] != '/')

- strbuf_addch(&url, '/');

- if (page) {

- url_arg(&url, page);

- strbuf_addch(&url, '/');

- }

- delimiter = "&";

- strbuf_addf(&url, "%s%s", delimiter, query);

- json_key("about_url"); { struct strbuf about = STRBUF_INIT; strbuf_addf(&about, "%s?p=about", cgit_rooturl()); json_value(about.buf); strbuf_release(&about); } json(",");

- json_key("log_url"); url = repo_url(repo, "log", ctx.qry.showmsg ? "showmsg=1" : NULL); json_value(url); free(url); json(",");

- json_key("tree_url"); url = repo_url(repo, "tree", NULL); json_value(url); free(url);

- const char *root = cgit_rooturl();

-

- if (!ctx.qry.url)

- return xstrdup(root);

- if (root[0] && root[strlen(root) - 1] == '/')

- return fmtalloc("%s%s", root, ctx.qry.url);

- return fmtalloc("%s/%s", root, ctx.qry.url);

- const char *root = cgit_rooturl();

- const char *orig_query = ctx.env.query_string ? ctx.env.query_string : "";

- size_t len = strlen(orig_query);

- char *query = xmalloc(len + 2), *start_url, *ret;

-

- /* Remove all url=... parts from query string */

- memcpy(query + 1, orig_query, len + 1);

- query[0] = '?';

- start_url = query;

- while ((start_url = strstr(start_url, "url=")) != NULL) {

- if (start_url[-1] == '?' || start_url[-1] == '&') {

- const char *end_url = strchr(start_url, '&');

- if (end_url)

- memmove(start_url, end_url + 1, strlen(end_url));

- else

- start_url[0] = '\0';

- } else

- ++start_url;

- }

- if (!query[1])

- query[0] = '\0';

- if (!ctx.qry.url)

- ret = fmtalloc("%s%s", root, query);

- else if (root[0] && root[strlen(root) - 1] == '/')

- ret = fmtalloc("%s%s%s", root, ctx.qry.url, query);

- else

- ret = fmtalloc("%s/%s%s", root, ctx.qry.url, query);

- free(query);

- return ret;

- if (ctx.cfg.virtual_root)

- return fmtalloc("%s%s/", ctx.cfg.virtual_root, reponame);

- else

- return fmtalloc("?r=%s", reponame);

- struct strbuf sb = STRBUF_INIT;

- char *delim;

-

- if (ctx.cfg.virtual_root) {

- strbuf_addf(&sb, "%s%s/%s/%s", ctx.cfg.virtual_root, reponame,

- pagename, (filename ? filename:""));

- delim = "?";

- } else {

- strbuf_addf(&sb, "?url=%s/%s/%s", reponame, pagename,

- (filename ? filename : ""));

- delim = "&amp;";

- }

- if (query)

- strbuf_addf(&sb, "%s%s", delim, query);

- return strbuf_detach(&sb, NULL);

- if (always_root || page)

- if (page) {

- htmlf("?p=%s", page);

- delim = "&amp;";

- }

-static char *repolink(const char *title, const char *class, const char *page,

- const char *head, const char *path)

- char *delim = "?";

-

- if (ctx.cfg.virtual_root) {

- html_url_path(ctx.cfg.virtual_root);

- html_url_path(ctx.repo->url);

- if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')

- html("/");

- if (page) {

- html_url_path(page);

- html("/");

- if (path)

- html_url_path(path);

- }

- } else {

- html_url_path(ctx.cfg.script_name);

- html("?url=");

- html_url_arg(ctx.repo->url);

- if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')

- html("/");

- if (page) {

- html_url_arg(page);

- html("/");

- if (path)

- html_url_arg(path);

- }

- delim = "&amp;";

- }

- if (head && ctx.repo->defbranch && strcmp(head, ctx.repo->defbranch)) {

- html(delim);

- html("h=");

- html_url_arg(head);

- delim = "&amp;";

- }

- return fmt("%s", delim);

- char *delim;

- delim = repolink(title, class, page, head, path);

- if (rev && ctx.qry.head != NULL && strcmp(rev, ctx.qry.head)) {

- html(delim);

- html("id=");

- html_url_arg(rev);

- reporevlink("tag", name, title, class, tag, NULL, NULL);

- delim = repolink(title, class, "log", head, path);

- if (rev && ctx.qry.head && strcmp(rev, ctx.qry.head)) {

- html(delim);

- html("id=");

- html_url_arg(rev);

- delim = "&amp;";

- }

- delim = repolink(title, class, "commit", head, path);

- if (rev && ctx.qry.head && strcmp(rev, ctx.qry.head)) {

- html(delim);

- html("id=");

- html_url_arg(rev);

- delim = "&amp;";

- }

- reporevlink("snapshot", name, title, class, head, rev, archivename);

- char *delim;

- delim = repolink(title, class, "diff", head, path);

- if (new_rev && ctx.qry.head != NULL && strcmp(new_rev, ctx.qry.head)) {

- html(delim);

- html("id=");

- html_url_arg(new_rev);

- delim = "&amp;";

- }

- if (old_rev) {

- html(delim);

- html("id2=");

- html_url_arg(old_rev);

- delim = "&amp;";

- reporevlink("patch", name, title, class, head, rev, path);

- else if (!strcmp(ctx.qry.page, "commit"))

- emit_css_link(NULL, "/cgit.css");

- emit_js_link(NULL, "/cgit.js");

- if (host && ctx.repo && ctx.qry.head) {

- struct strbuf sb = STRBUF_INIT;

- strbuf_addf(&sb, "h=%s", ctx.qry.head);

- fileurl = cgit_fileurl(ctx.repo->url, "atom", ctx.qry.vpath,

- sb.buf);

- strbuf_release(&sb);

- else if (ctx.cfg.clone_prefix)

- add_clone_urls(fn, ctx.cfg.clone_prefix, ctx.repo->url);

-static int print_branch_option(const struct reference *ref, void *cb_data)

- char *name = (char *)ref->name;

- html_option(name, name, ctx.qry.head);

-void cgit_add_hidden_formfields(int incl_head, int incl_search,

- const char *page)

- if (!ctx.cfg.virtual_root) {

- struct strbuf url = STRBUF_INIT;

-

- strbuf_addf(&url, "%s/%s", ctx.qry.repo, page);

- if (ctx.qry.vpath)

- strbuf_addf(&url, "/%s", ctx.qry.vpath);

- html_hidden("url", url.buf);

- strbuf_release(&url);

- }

-

- if (incl_head && ctx.qry.head && ctx.repo->defbranch &&

- strcmp(ctx.qry.head, ctx.repo->defbranch))

- html_hidden("h", ctx.qry.head);

-

- if (ctx.qry.oid)

- html_hidden("id", ctx.qry.oid);

- if (ctx.qry.oid2)

- html_hidden("id2", ctx.qry.oid2);

- cgit_self_link("root", NULL, NULL);

- cgit_self_link(p, NULL, NULL);

- html("<form method='get'>\n");

- cgit_add_hidden_formfields(0, 1, ctx.qry.page);

- html("<select name='h' onchange='this.form.submit();'>\n");

- html("</select> ");

- html("<input type='submit' value='switch'/>");

- html("</form>");

- cgit_commit_link("commit", NULL, hc("commit"),

- html_url_path(fileurl);

- char *id_str = fmt("id=%s#%s", is_null_oid(&old_file->oid)?"HEAD":oid_to_hex(old_rev_oid), lineno_str);

- char *fileurl = cgit_fileurl(ctx.repo->url, "tree", old_file->path, id_str);

- char *id_str = fmt("id=%s#%s", is_null_oid(&new_file->oid)?"HEAD":oid_to_hex(new_rev_oid), lineno_str);

- char *fileurl = cgit_fileurl(ctx.repo->url, "tree", new_file->path, id_str);

- html_url_path(url);

- strbuf_addf(&fullref, "refs/tags/%s", revname);

- "Bad tag reference: %s", revname);

- "Bad tag object: %s", revname);

- html_txt(revname);

- html_txt(revname);

-cgit is anonymous and read-only and scans the complete repository directory.

-Consequently every repository available over SSH is also publicly visible over

-HTTP. Web cloning and snapshots are disabled in the default policy.

- path: /healthz

- path: /healthz

- path: /healthz

- let body = axum::body::to_bytes(body, 1024 * 1024)

- let cache_key = CacheKey::from_request(&parts, &body);

- ("CGIT_CSS", "/cgit.css"),

- ("CGIT_ENABLE_BLAME", "0"),

- ("CGIT_ENABLE_HTML_SERVING", "0"),

- ("CGIT_ENABLE_HTTP_CLONE", "0"),

- ("CGIT_FAVICON", "/favicon.ico"),

- ("CGIT_JS", ""),

- ("CGIT_LOGO", "/cgit.png"),

- ("CGIT_MAX_STATS", "0"),

- ("CGIT_SNAPSHOTS", "0"),

-struct AppState {

- check_files()?;

- let state = AppState { cgit };

- "/healthz",

- axum::routing::get(async || plain_response(axum::http::StatusCode::OK, "ok\n")),

- "/cgit.css",

- "/cgit.js",

- "/cgit.png",

- "/favicon.ico",

- .fallback(proxy_to_cgit)

- .with_state(state);

-fn check_files() -> std::io::Result<()> {

- let metadata = std::fs::metadata(CGIT)?;

- if !metadata.is_file()

- || std::os::unix::fs::PermissionsExt::mode(&metadata.permissions()) & 0o111 == 0

- {

- return Err(std::io::Error::other(format!("{CGIT} is not executable")));

-async fn proxy_to_cgit(

- axum::extract::State(state): axum::extract::State<AppState>,

- axum::extract::ConnectInfo(remote): axum::extract::ConnectInfo<std::net::SocketAddr>,

- mut request: axum::extract::Request,

-) -> axum::response::Response {

- if request.method() != axum::http::Method::GET && request.method() != axum::http::Method::HEAD {

- return plain_response(axum::http::StatusCode::FORBIDDEN, "forbidden\n");

- request.extensions_mut().insert(cgi::RemoteAddr(remote));

- let method = request.method().clone();

- match tower::ServiceExt::oneshot(state.cgit.clone(), request).await {

- Ok(response) => render_private_page(method, response).await,

- Err(error) => {

- eprintln!("gilti: cgit request failed: {error}");

- plain_response(axum::http::StatusCode::BAD_GATEWAY, "bad gateway\n")

- return plain_response(axum::http::StatusCode::BAD_GATEWAY, "bad gateway\n");

- plain_response(axum::http::StatusCode::BAD_GATEWAY, "bad gateway\n")

- let model = br#"{"page":"repolist","title":"Gilti","root_desc":"","root_url":"/","about_url":"/?p=about","noheader":true,"search":"","current_url":"/","root_readme":false,"owner_enabled":false,"links_enabled":false,"section_grouping":false,"shell":{"embedded":false,"robots":"","css":[],"js":[],"favicon":"","head_include":null,"header":null,"footer_configured":false,"footer":null,"logo":"","logo_link":"","cgit_version":"v1","git_version":"2","generated_at":"now"},"sort_urls":{"name":"/?s=name","desc":"/?s=desc","owner":"/?s=owner","idle":"/?s=idle"},"rows":[],"pager":[]}"#;

- axum::http::StatusCode::BAD_GATEWAY

- log_url: String,

- tree_url: String,

- link rel="stylesheet" type="text/css" href="/cgit.css";

- script type="text/javascript" src="/cgit.js" {}

- @if page.links_enabled { td { a class="button" href=(&repo.url) { "summary" } a class="button" href=(&repo.log_url) { "log" } a class="button" href=(&repo.tree_url) { "tree" } } }

- until curl -fsS "http://127.0.0.1:$http_port/healthz" >/dev/null 2>&1; do

-[ "$(curl -fsS "http://127.0.0.1:$http_port/healthz")" = ok ] || {

-[ "$status" = 403 ] || {

- echo "POST to cgit returned HTTP $status instead of 403" >&2

-curl -fsS "http://127.0.0.1:$http_port/cgit.css" | grep -q 'cgit'

-content_type=$(curl -fsSI "http://127.0.0.1:$http_port/cgit.css" |

-curl -fsS "http://127.0.0.1:$http_port/cgit.js" | grep -q 'function'

-content_type=$(curl -fsSI "http://127.0.0.1:$http_port/cgit.js" |

-curl -fsSI "http://127.0.0.1:$http_port/healthz" >/dev/null

-cache_url="http://127.0.0.1:$http_port/testing/"