From 8ef9b0fe88470125d6ee60a3ea0bab796048e692 Mon Sep 17 00:00:00 2001
From: Matthias Lucas Jaros <jarlucmat@mailbox.org>
Date: Mon, 20 Oct 2025 12:23:03 +0200
Subject: Security hardening

---
 src/init | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'src/init')

diff --git a/src/init b/src/init
index b9222f4..e292d59 100755
--- a/src/init
+++ b/src/init
@@ -1,14 +1,14 @@
 #!/usr/bin/env fish
 
+# load environment
+source (dirname (status --current-filename))/env
+
 #
 #
 # function definitions
 #
 #
 
-set _REPO_PERMISSIONS_FILE /etc/repo-permissions
-set _REPO_VALIDATION_REGEX "^((?:\/[a-zA-Z-]+)+.git)\$"
-
 function createUser
 	set -l userConfig (string split ':' $argv[1])
 	set -l user $userConfig[1]
@@ -37,9 +37,9 @@ function setupRepo
 	set -l repo $parsedConfig[1]
 
 	# check repo name
-	set -l matcher (string match -r -g $_REPO_VALIDATION_REGEX $repo)
+	set -l matcher (string match -r -g "^$_REPO_VALIDATION_REGEX\$" $repo)
 	if test -z $matcher[1]
-		echo "Invalid repo name $repo"
+		echo "Failed to setup repo, invalid path/name: $repo"
 		return 1
 	end
 
@@ -102,6 +102,7 @@ end
 # git user has read/write access to all repos, set git-shell
 # and no password login allowed -> no ssh login possible
 adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell"
+passwd -l git
 for userConfig in $users
 	createUser "$userConfig"
 end
@@ -112,6 +113,9 @@ for repoConfig in $repos
 	setupRepo "$repoConfig"
 end
 
+# create writable log file
+touch $LOG && chmod 777 $LOG
+
 echo "Setting up server"
 # generate host keys in case
 mkdir -p /var/ssh/etc/ssh/ && ssh-keygen -A -f /var/ssh
-- 
cgit v1.3.1