# git.syndamia.com CLI

Command-line utilities for managing my git repositories (creating a new repo, making it public/private, ...).

## Usage

The way I use them is by ssh-ing into my server in a chroot jail, which contains these, and only these, tools.

I'll be the only one directly using <https://git.syndamia.com>, so I've opted to *not* use a software forge or any other fine-grained access control program (e.g. [gitolite](https://gitolite.com/gitolite/index.html)).
As you'll see from the `new` script, repositories are stored as bare and [git over ssh](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols.html#_the_ssh_protocol) is used for push/pull operations (thank you [tsoding](https://www.youtube.com/watch?v=iuIdBfjL62s)).

## Setup

Do note, I've only done this once for my server, manually.
If ever do it again, I'll setup scripts for an automated configuration.

### chroot jail

The best tutorial for a n00b like me was <https://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/>.
[Appendix B.7](https://web.archive.org/web/20260424212124/https://www.debian.org/doc/manuals/securing-debian-manual/chroot-ssh-env.en.html) from the severely outdated Securing Debian Manual also helped.

Some extra sshd configuration options which should always be added are:

```
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
```

Documentation can be found on the [sshd_config man page](https://www.man7.org/linux/man-pages/man5/sshd_config.5.html).

### External dependencies

The primary utilities in this repository are simple shell scripts, however for them to work, a shell and some UNIX programs need to be available.
Since I'm jailing the ssh-ed user, every program, alongside its dynamically-linked libraries, needs to be copied over.

All `.list` files contain newline-separated names of **external** files and directories, relative to the root directory, which need to be **copied** into the jail root.

- `libs.list` - all needed dynamically-allocated libraries
- `bins.list` - all needed precompiled binaries.
- `devs.list` - all needed devices (they are all pseudo-devices, not related to actual hardware)

You also **must create `/tmp` directory**!
Otherwise, git commands will not work properly.