13 files changed, 247 insertions, 0 deletions
diff --git a/etc/acme-client.conf b/etc/acme-client.conf
new file mode 100644
index 0000000..ae60462
--- /dev/null
+++ b/etc/acme-client.conf
@@ -0,0 +1,21 @@
+#
+# $OpenBSD: acme-client.conf,v 1.6 2025/08/18 15:51:57 job Exp $
+#
+authority letsencrypt {
+	api url "https://acme-v02.api.letsencrypt.org/directory"
+	account key "/etc/acme/letsencrypt-privkey.pem"
+}
+
+authority letsencrypt-staging {
+	api url "https://acme-staging-v02.api.letsencrypt.org/directory"
+	account key "/etc/acme/letsencrypt-staging-privkey.pem"
+}
+
+domain bookcorner.ge {
+	alternative names { www.bookcorner.ge git.bookcorner.ge }
+	domain key "/etc/ssl/private/bookcorner.ge.key"
+	domain full chain certificate "/etc/ssl/bookcorner.ge.fullchain.pem"
+	# Test with the staging server to avoid aggressive rate-limiting.
+	#sign with letsencrypt-staging
+	sign with letsencrypt
+}
diff --git a/etc/doas.conf b/etc/doas.conf
new file mode 100644
index 0000000..d74f89d
--- /dev/null
+++ b/etc/doas.conf
@@ -0,0 +1,13 @@
+# $OpenBSD: doas.conf,v 1.1 2016/09/03 11:58:32 pirofti Exp $
+# See doas.conf(5) for syntax and examples.
+
+# Non-exhaustive list of variables needed to build release(8) and ports(7)
+#permit nopass setenv { \
+#    FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \
+#    DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \
+#    MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \
+#    PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \
+#    SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
+
+# Allow wheel by default
+permit persist keepenv :wheel
diff --git a/etc/exports b/etc/exports
new file mode 100644
index 0000000..1d45f46
--- /dev/null
+++ b/etc/exports
@@ -0,0 +1,7 @@
+#	$OpenBSD: exports,v 1.1 2014/07/12 03:52:39 deraadt Exp $
+#
+# NFS exports Database
+# See exports(5) for more information.  Be very careful:  misconfiguration
+# of this file can result in your filesystems being readable by the world.
+
+/home/git/repositories -ro -maproot=root localhost
diff --git a/etc/fstab b/etc/fstab
new file mode 100644
index 0000000..fb3b019
--- /dev/null
+++ b/etc/fstab
@@ -0,0 +1,3 @@
+7b4a8f66b5a2f8af.a / ffs rw,wxallowed 1 1
+
+localhost:/home/git/repositories /var/www/git/repositories nfs ro,nodev,nosuid 0 0
diff --git a/etc/hosts b/etc/hosts
new file mode 100644
index 0000000..d5be630
--- /dev/null
+++ b/etc/hosts
@@ -0,0 +1,2 @@
+127.0.0.1	localhost
+::1		localhost
diff --git a/etc/httpd.conf b/etc/httpd.conf
new file mode 100644
index 0000000..47348e0
--- /dev/null
+++ b/etc/httpd.conf
@@ -0,0 +1,56 @@
+types {
+	include "/usr/share/misc/mime.types"
+}
+
+server "bookcorner.ge" {
+	include "/etc/httpd/_listen80.conf"
+	include "/etc/httpd/_acme.conf"
+
+	location "*" {
+		# HTTP 301 Moved Permanently - enforce HTTPS
+		block return 301 "https://bookcorner.ge$REQUEST_URI"
+	}
+}
+
+server "bookcorner.ge" {
+	include "/etc/httpd/_listen443.conf"
+	include "/etc/httpd/_acme.conf"
+
+	location "*" {
+		block return 307 "http://git.bookcorner.ge"
+	}
+}
+
+server "www.bookcorner.ge" {
+	include "/etc/httpd/_listen80.conf"
+	include "/etc/httpd/_listen443.conf"
+	include "/etc/httpd/_acme.conf"
+
+	location "*" {
+		# HTTP 301 Moved Permanently - enforce non-www site
+		block return 301 "https://bookcorner.ge$REQUEST_URI"
+	}
+}
+
+server "git.bookcorner.ge" {
+	include "/etc/httpd/_listen80.conf"
+	include "/etc/httpd/_acme.conf"
+
+	location "*" {
+		# HTTP 301 Moved Permanently - enforce HTTPS
+		block return 301 "https://git.bookcorner.ge$REQUEST_URI"
+	}
+}
+
+server "git.bookcorner.ge" {
+	include "/etc/httpd/_listen443.conf"
+	include "/etc/httpd/_acme.conf"
+
+	location "/cgit.*" {
+		root "/cgit"
+		no fastcgi
+	}
+
+	root "/cgi-bin/cgit.cgi"
+	fastcgi socket "/run/slowcgi.sock"
+}
diff --git a/etc/httpd/_acme.conf b/etc/httpd/_acme.conf
new file mode 100644
index 0000000..3c1a0ec
--- /dev/null
+++ b/etc/httpd/_acme.conf
@@ -0,0 +1,4 @@
+location "/.well-known/acme-challenge/*" {
+	root "/acme"
+	request strip 2
+}
diff --git a/etc/httpd/_listen443.conf b/etc/httpd/_listen443.conf
new file mode 100644
index 0000000..12ffc19
--- /dev/null
+++ b/etc/httpd/_listen443.conf
@@ -0,0 +1,8 @@
+listen on * tls port 443
+
+tls {
+	certificate "/etc/ssl/bookcorner.ge.fullchain.pem"
+	key "/etc/ssl/private/bookcorner.ge.key"
+}
+
+hsts preload
diff --git a/etc/httpd/_listen80.conf b/etc/httpd/_listen80.conf
new file mode 100644
index 0000000..8e0f854
--- /dev/null
+++ b/etc/httpd/_listen80.conf
@@ -0,0 +1 @@
+listen on * port 80
diff --git a/etc/pf.conf b/etc/pf.conf
new file mode 100644
index 0000000..ecf2183
--- /dev/null
+++ b/etc/pf.conf
@@ -0,0 +1,14 @@
+#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
+#
+# See pf.conf(5) and /etc/examples/pf.conf
+
+set skip on lo
+
+block return	# block stateless traffic
+pass		# establish keep-state
+
+# By default, do not permit remote connections to X11
+block return in on ! lo0 proto tcp to port 6000:6010
+
+# Port build user does not need network
+block return out log proto {tcp udp} user _pbuild
diff --git a/etc/rc.conf.local b/etc/rc.conf.local
new file mode 100644
index 0000000..468a7d0
--- /dev/null
+++ b/etc/rc.conf.local
@@ -0,0 +1,5 @@
+httpd_flags=
+mountd_flags=
+nfsd_flags=
+portmap_flags=
+slowcgi_flags=
diff --git a/etc/shells b/etc/shells
new file mode 100644
index 0000000..7dff12e
--- /dev/null
+++ b/etc/shells
@@ -0,0 +1,10 @@
+#	$OpenBSD: shells,v 1.8 2009/02/14 17:06:40 sobrado Exp $
+#
+# list of acceptable shells for chpass(1).
+# ftpd(8) will not allow users to connect who are not using
+# one of these shells, unless the user is listed in /etc/ftpchroot.
+/bin/sh
+/bin/csh
+/bin/ksh
+/usr/local/bin/git-shell
+/usr/local/libexec/gitolite/gitolite-shell
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
new file mode 100644
index 0000000..305e84b
--- /dev/null
+++ b/etc/ssh/sshd_config
@@ -0,0 +1,103 @@
+#	$OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to "no" here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to "no" to disable keyboard-interactive authentication.  Depending on
+# the system's configuration, this may involve passwords, challenge-response,
+# one-time passwords or some combination of these and other methods.
+#KbdInteractiveAuthentication yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+TCPKeepAlive yes
+PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
+
+Match User git
+       AllowAgentForwarding no
+       AllowTcpForwarding no
+       GatewayPorts no
+       X11Forwarding no
+       PermitTTY no
+       PermitTunnel no