From bf9ccd1a685070e5532191e34858e870d3543aa1 Mon Sep 17 00:00:00 2001
From: benaryorg <binary@benary.org>
Date: Mon, 5 Jan 2026 14:58:07 +0000
Subject: [PATCH] nixos/cgit: handle unset `strict-export` option

The new export check mechanic introduced in #475112 does check whether or not the `strict-export` setting is set for *cgit* to catch configurations with lacking or superfluous options.
This change ensures that the assert statements do not cause evaluation errors when the setting is absent.
Instead the absense is handled appropriately for each assert.
When the option is required to be set to a specific value it will cause the assertion to fail, thereby displaying the assertion message rather than an evaluation error.
In case the option is required to be unset it may now be either null or unset, instead of failing the evaluation.

As an example, prior to this commit having `checkExportOkFiles` set to false, and `strict-export` entirely unset did fail the evaluation of the assert.
Now this is a valid pattern, meaning users who want to allow access to all repositories need only specify `checkExportOkFiles = false`, and can leave `strict-export` unset.

Signed-off-by: benaryorg <binary@benary.org>
---
 nixos/modules/services/networking/cgit.nix | 25 ++++++++++++++--------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/networking/cgit.nix b/nixos/modules/services/networking/cgit.nix
index 63d247a9e068..db0fa913cde4 100644
--- a/nixos/modules/services/networking/cgit.nix
+++ b/nixos/modules/services/networking/cgit.nix
@@ -217,7 +217,8 @@ in
                   When enabled you must also configure `strict-export = "git-daemon-export-ok"`
                   in `settings` to make cgit check for the same files.
                 '';
-                type = lib.types.bool;
+                type = lib.types.nullOr lib.types.bool;
+                default = null;
               };
             };
           }
@@ -235,18 +236,24 @@ in
         }
         {
           assertion =
-            !cfg.enable
-            || !cfg.gitHttpBackend.enable
-            || !cfg.gitHttpBackend.checkExportOkFiles
-            || cfg.settings.strict-export == "git-daemon-export-ok";
+            cfg.enable -> cfg.gitHttpBackend.enable -> cfg.gitHttpBackend.checkExportOkFiles != null;
+          message = "Misconfigured services.cgit.${vhost}: When gitHttpBackend.enable is true then gitHttpBackend.checkExportOkFiles must be set, see the documentation for the option for further information.";
+        }
+        {
+          assertion =
+            cfg.enable
+            -> cfg.gitHttpBackend.enable
+            -> cfg.gitHttpBackend.checkExportOkFiles
+            -> (cfg.settings ? strict-export && cfg.settings.strict-export == "git-daemon-export-ok");
           message = "Misconfigured services.cgit.${vhost}: When gitHttpBackend.checkExportOkFiles is true then settings.strict-export must be \"git-daemon-export-ok\".";
         }
         {
           assertion =
-            !cfg.enable
-            || !cfg.gitHttpBackend.enable
-            || cfg.settings.strict-export == null
-            || cfg.gitHttpBackend.checkExportOkFiles;
+            cfg.enable
+            -> cfg.gitHttpBackend.enable
+            -> !cfg.gitHttpBackend.checkExportOkFiles
+            -> cfg.settings ? strict-export
+            -> cfg.settings.strict-export == null;
           message = "Misconfigured services.cgit.${vhost}: settings.strict-export is set but the gitHttpBackend is enabled and checkExportOkFiles is false.";
         }
       ]) cfgs