Can you please paste the configuration of your use case?

Sure, here is my basic example configuration.

# git.nix
{
  resources.sshKeyPairs.ssh-key = {};
  network.description = "Git server";
  webserver = {
    deployment.targetEnv = "digitalOcean";
    deployment.digitalOcean = {
      enableIpv6 = true;
      region = "fra1";
      size = "s-1vcpu-1gb";
    };
    imports = [ ./gitolite.nix ./gitweb.nix ];
  };
}

# gitolite.nix
{ config, ... }:

let
  cfg = config.services.gitolite;
in {
  services.gitolite = {
    enable = true;
    user = "git";
    group = "git";
    dataDir = "/home/git";
    adminPubkey = builtins.readFile ./id_rsa.pub;
    extraGitoliteRc = ''
      $RC{UMASK} = 0027;
    '';
  };
  systemd.services."gitolite-init".script = ''
    chmod g+rx ${cfg.dataDir}
  '';
  networking.firewall.allowedTCPPorts = [ 22 ];
}

# gitweb.nix
{
  services.gitweb.projectroot = "/home/git/repositories";
  services.lighttpd.enable = true;
  services.lighttpd.gitweb.enable = true;
  users.users.lighttpd.extraGroups = [ "git" ];
  networking.firewall.allowedTCPPorts = [ 80 ];
}

@bake Thanks for the example.

Without actually having tested this at all I wonder if this is a better approach to achieve the same goal: https://github.com/NixOS/nixpkgs/compare/master...aanderse:gitolite?expand=1

Thank you, I've just tested your modification and it works as expected. It also looks cleaner than just expanding the shellscript.

Out of curiosity: Do we need the Zin systemd.tmpfiles.rules? I'm not familiar with tmpfiles, but it looks like it doesn't change anything, since the directories already got those permissions.

@bake Glad to hear it works. The Z is not always required, but sometimes nice to have just in case:

Recursively set the access mode, user and group ownership, and restore the SELinux security context of a file or directory if it exists, as well as of its subdirectories and the files contained therein (if applicable).

If you want to merge my changes into this PR please go ahead, otherwise I can open a PR from my branch and cc you in.

Thank you, I've merged your changes.

@bake Can you please squash all commits into a single?

Sure

This pull request has been mentioned on Nix community. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review-may-2019/3032/29

@GrahamcOfBorg test gitolite

Thanks @teto and @bake!

Thank you!