vextoly/gitman

# Install as /etc/nginx/snippets/gitman-server.conf; HTTPS app servers only.
include /etc/nginx/snippets/gitman-cloudflare-realip.conf;
server_tokens off;
client_max_body_size 64k;
client_header_timeout 15s;
client_body_timeout 30s;
send_timeout 60s;
keepalive_timeout 20s;
keepalive_requests 500;
reset_timedout_connection on;
proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 60s;
proxy_http_version 1.1;
proxy_request_buffering on;
proxy_next_upstream off;
# Each location inherits this complete set. Do not partially override it.
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Ssl "";
proxy_set_header Forwarded "";
proxy_set_header CF-Connecting-IP "";
proxy_set_header Connection "";
limit_req zone=gitman_requests burst=80 nodelay;
limit_req zone=gitman_auth burst=10 nodelay;
limit_req_status 429;
limit_conn gitman_clients 32;
limit_conn gitman_total 128;
limit_conn_status 429;
access_log /var/log/nginx/gitman-access.log gitman_safe;
add_header Strict-Transport-Security $gitman_hsts always;
# Keep application CSP/frame policies out of nginx: Pages has a different policy.
if ($request_method !~ ^(GET|HEAD|POST)$) { return 405; }

# Git pack plus framing allowance; align with the app's 256 MiB repository cap.
location ^~ /git/ {
    client_max_body_size 257m;
    client_body_timeout 120s;
    proxy_read_timeout 7200s;
    proxy_send_timeout 120s;
    proxy_buffering off;
    limit_conn gitman_clients 32;
    limit_conn gitman_total 128;
    limit_conn gitman_git_clients 4;
    limit_conn gitman_git_total 8;
    proxy_pass http://unix:/run/gitman/gunicorn.sock;
}
# Legacy multipart bundle uploads share the settings endpoint with small forms.
location ~ ^/[^/]+/[^/]+/settings(?:/import-bundle(?:/chunk)?)?$ {
    client_max_body_size 257m;
    client_body_timeout 120s;
    proxy_read_timeout 7500s;
    proxy_send_timeout 120s;
    proxy_buffering off;
    limit_conn gitman_clients 32;
    limit_conn gitman_total 128;
    limit_conn gitman_import_clients 2;
    limit_conn gitman_import_total 4;
    proxy_pass http://unix:/run/gitman/gunicorn.sock;
}
# Diff/archive generation can take longer on a repository near its quota.
location ~ ^/[^/]+/[^/]+/(?:archive/|commits/[0-9a-fA-F]+$|pulls/[0-9]+$) {
    proxy_read_timeout 300s;
    proxy_pass http://unix:/run/gitman/gunicorn.sock;
}
location / {
    proxy_pass http://unix:/run/gitman/gunicorn.sock;
}