From 5dd428d9361ecde974566b9d88e5d20affb5cd39 Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sun, 25 Oct 2026 08:22:31 +0100
Subject: refactor(tente): host geopos under geopos.push-f.com

---
 nixos/hosts/tente/default.nix |  9 +++++---
 nixos/hosts/tente/git-web.nix | 49 ++++++++++++++++++++++++++++++-------------
 2 files changed, 41 insertions(+), 17 deletions(-)

(limited to 'nixos/hosts/tente')

diff --git a/nixos/hosts/tente/default.nix b/nixos/hosts/tente/default.nix
index 5e7b278..82d58bb 100644
--- a/nixos/hosts/tente/default.nix
+++ b/nixos/hosts/tente/default.nix
@@ -30,7 +30,7 @@ in
     "${sources.my-git-grep-exporter}/service.nix"
     "${sources.my-lex-surf}/service.nix"
     "${sources.my-osm-proposals}/service.nix"
-    "${sources.my-geopos-link}/service.nix"
+    "${sources.my-geopos}/service.nix"
     "${sources.my-rust-features}/service.nix"
     "${sources.my-spec-pub}/service.nix"
     "${sources.my-web-feed-exporter}/service.nix"
@@ -152,11 +152,14 @@ in
     reposDir = reposDir;
     user = "cgit";
     group = "cgit";
+    repoRedirects = {
+      "geopos.link" = "geopos";
+    };
   };
 
-  services.geopos-share =
+  services.geopos =
     let
-      domain = "geopos.link";
+      domain = "geopos.${baseDomain}";
     in
     {
       enable = true;
diff --git a/nixos/hosts/tente/git-web.nix b/nixos/hosts/tente/git-web.nix
index 9e8063c..a7d0fa1 100644
--- a/nixos/hosts/tente/git-web.nix
+++ b/nixos/hosts/tente/git-web.nix
@@ -18,6 +18,17 @@ in
     group = lib.mkOption {
       type = lib.types.str;
     };
+    repoRedirects = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = {
+        old-name = "new-name";
+      };
+      description = ''
+        Mapping of old repository names to their new names. Requests for an old
+        repository and any paths below it are permanently redirected.
+      '';
+    };
   };
 
   config = {
@@ -32,22 +43,32 @@ in
       # use fake browser user agents and hundreds of IP addresses.
       # The number of possible URLs is O(commits x files), which can be a lot,
       # so we guard the /<repo>/tree/<path>?id=<commit> endpoint with Basic Auth.
-      locations."/".extraConfig =
-        let
-          cgitHtpasswd = pkgs.writeText "cgit.htpasswd" "guest:{PLAIN}\n";
-        in
-        ''
-          set $auth off;
-          # Unfortunately mainstream browsers don't display the realm anymore.
-          set $realm "The username is guest, the password is blank.";
+      locations = {
+        "/".extraConfig =
+          let
+            cgitHtpasswd = pkgs.writeText "cgit.htpasswd" "guest:{PLAIN}\n";
+          in
+          ''
+            set $auth off;
+            # Unfortunately mainstream browsers don't display the realm anymore.
+            set $realm "The username is guest, the password is blank.";
 
-          # We disallow /tree/ with URL query parameters.
-          if ($request_uri ~ ^/[^/]+/tree(/[^?]*)?/?\?.+$) { set $auth $realm; }
-          if ($request_uri ~ ^/[^/]+/diff(/|$|\?))         { set $auth $realm; }
+            # We disallow /tree/ with URL query parameters.
+            if ($request_uri ~ ^/[^/]+/tree(/[^?]*)?/?\?.+$) { set $auth $realm; }
+            if ($request_uri ~ ^/[^/]+/diff(/|$|\?))         { set $auth $realm; }
 
-          auth_basic $auth;
-          auth_basic_user_file ${cgitHtpasswd};
-        '';
+            auth_basic $auth;
+            auth_basic_user_file ${cgitHtpasswd};
+          '';
+      }
+      // lib.mapAttrs' (
+        oldRepo: newRepo:
+        lib.nameValuePair "~ ^/${lib.escapeRegex oldRepo}(?<repoPath>/.*)?$" {
+          # This must precede cgit's regex location for git-http-backend.
+          priority = 500;
+          extraConfig = "return 301 /${newRepo}$repoPath$is_args$args;";
+        }
+      ) cfg.repoRedirects;
     };
 
     services.cgit.main = {
-- 
cgit v1.3.1