feat!: Initial setup

1 files changed, 45 insertions, 0 deletions

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..53b62ea
--- /dev/null
+++ b/README.md
@@ -0,0 +1,45 @@
+# git.syndamia.com CLI
+
+Command-line utilities for managing my git repositories (creating a new repo, making it public/private, ...).
+
+## Usage
+
+The way I use them is by ssh-ing into my server in a chroot jail, which contains these, and only these, tools.
+
+I'll be the only one directly using <https://git.syndamia.com>, so I've opted to *not* use a software forge or any other fine-grained access control program (e.g. [gitolite](https://gitolite.com/gitolite/index.html)).
+As you'll see from the `new` script, repositories are stored as bare and [git over ssh](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols.html#_the_ssh_protocol) is used for push/pull operations (thank you [tsoding](https://www.youtube.com/watch?v=iuIdBfjL62s)).
+
+## Setup
+
+Do note, I've only done this once for my server, manually.
+If ever do it again, I'll setup scripts for an automated configuration.
+
+### chroot jail
+
+The best tutorial for a n00b like me was <https://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/>.
+[Appendix B.7](https://web.archive.org/web/20260424212124/https://www.debian.org/doc/manuals/securing-debian-manual/chroot-ssh-env.en.html) from the severely outdated Securing Debian Manual also helped.
+
+Some extra sshd configuration options which should always be added are:
+
+```
+PermitTunnel no
+AllowAgentForwarding no
+AllowTcpForwarding no
+X11Forwarding no
+```
+
+Documentation can be found on the [sshd_config man page](https://www.man7.org/linux/man-pages/man5/sshd_config.5.html).
+
+### External dependencies
+
+The primary utilities in this repository are simple shell scripts, however for them to work, a shell and some UNIX programs need to be available.
+Since I'm jailing the ssh-ed user, every program, alongside its dynamically-linked libraries, needs to be copied over.
+
+All `.list` files contain newline-separated names of **external** files and directories, relative to the root directory, which need to be **copied** into the jail root.
+
+- `libs.list` - all needed dynamically-allocated libraries
+- `bins.list` - all needed precompiled binaries.
+- `devs.list` - all needed devices (they are all pseudo-devices, not related to actual hardware)
+
+You also **must create `/tmp` directory**!
+Otherwise, git commands will not work properly.