1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96
97. 97
98. 98
99. 99
100. 100
101. 101
102. 102
103. 103
104. 104

<!--
Copyright 2025 Shota FUJI <pockawoooh@gmail.com>
SPDX-License-Identifier: MIT
-->

# legit

legit is a web frontend for git repositories, written in Go.

This code is a fork of <https://github.com/icyphox/legit>, with HTML/CSS/JS customization and typed template pipelines.
I'm using legit along with [soft-serve](https://github.com/charmbracelet/soft-serve) and this fork is optimized for this usecase; good browsing experience, minimum Git operation for security and integration for soft-serve.

## Features

- Repository browsing; commits, refs, tree, etc.
- Simple deployment; single binary without CGI.
- Template customization; modify HTML/CSS/JS to your liking.
- Supports GitWeb-compatible description and category display.
- Secure readonly file access with unveil (OpenBSD) and Landlock (Linux).

## Requirements

- Building and running without building requires Go toolchain >= v1.25.0.
- Both Linux and macOS is supported.
- Put TLS terminating proxy such as nginx or Caddy in front of legit.

## Install

### Manual

Clone and run `go build` at repository root directory.
Go compiler generates `legit` executable file at the repository root directory.

You can also run legit without installing by `go run .`.

legit uses unveil(2) on OpenBSD and Landlock LSM on Linux.
If you find unexpected filesystem permission error, add the _directory_ to `main.additionalAccessDirs` ldflag.
That flag takes comma-separated list of directories, and unveil/Landlock allows a readonly access to that paths.

### Nix

Add this repository as a Flake input and use `nixosModules.default` or `homeManagerModules.default`.

```nix
# your/flake.nix
{
	inputs = {
		# --- snip ---

		legit = {
			url = "github:pocka/legit";
			inputs.nixpkgs.follows = "nixpkgs"; # optional
		};
	};

	outputs =
		{ nixpkgs, legit, ... }:
		{
			nixosConfigurations.foo = nixpkgs.lib.nixosSystem {
				# --- snip ---

				modules = [
					# --- snip ---
					legit.nixosModules.default
				];
			};
		};
}
```

### OCI (Docker, Podman)

Build the image on the project root.
The image exposes TCP port 5555 for HTTP server.

Generated image expectes two volume mounts:

- `/var/www/legit` ... a directory containing git repositories to host.
- `/etc/legit/config.yaml` ... config file for UI and metadata customization.

Example commands using podman:

```sh
podman build . -t pocka/legit
podman run -v ./demo:/var/www/legit -v ./config.yaml:/etc/legit/config.yaml --publish 5555:5555 pocka/legit:latest
```

OCI image entrypoint overwrites these config options, so values inside your `config.yaml` will be ignored:

- `server.host`
- `server.port`
- `repo.scanPath`

## Configuration

legit reads YAML config file. Create YAML file somewhere (e.g. `$XDG_CONFIG_HOME/legit/config.yaml`) and pass the path to legit via `--config` flag.
See the sample [`config.yaml`](./config.yaml) for more info.

## License

This software is licensed under MIT.
See `LICENSE` file for license text.

Newly added files have [REUSE](https://reuse.software/) compliant comment headers for easier per-file use.