2 files changed, 49 insertions, 2 deletions
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index f907fe871..1cabeae27 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -3,7 +3,7 @@
 with builtins;
 with lib;
 
-rec {
+let out = rec {
 
   eq = x: y: x == y;
 
@@ -17,6 +17,7 @@ rec {
   dir.has-default-nix = path: pathExists (path + "/default.nix");
 
   dns = import ./dns.nix { inherit lib; };
+  git = import ./git.nix { lib = lib // out; };
   listset = import ./listset.nix { inherit lib; };
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
@@ -30,4 +31,8 @@ rec {
   subdirsOf = path:
     mapAttrs (name: _: path + "/${name}")
              (filterAttrs (_: eq "directory") (readDir path));
-}
+
+  mapAttrValues = f: mapAttrs (_: f);
+  setAttr = name: value: set: set // { ${name} = value; };
+
+}; in out
diff --git a/krebs/4lib/git.nix b/krebs/4lib/git.nix
new file mode 100644
index 000000000..d50ba2018
--- /dev/null
+++ b/krebs/4lib/git.nix
@@ -0,0 +1,42 @@
+{ lib, ... }:
+
+let
+  inherit (lib) addNames escapeShellArg makeSearchPath optionalString;
+
+  commands = addNames {
+    git-receive-pack = {};
+    git-upload-pack = {};
+  };
+
+  receive-modes = addNames {
+    fast-forward = {};
+    non-fast-forward = {};
+    create = {};
+    delete = {};
+    merge = {}; # TODO implement in git.nix
+  };
+
+  permissions = {
+    fetch = {
+      allow-commands = [
+        commands.git-upload-pack
+      ];
+    };
+
+    push = ref: extra-modes: {
+      allow-commands = [
+        commands.git-receive-pack
+        commands.git-upload-pack
+      ];
+      allow-receive-ref = ref;
+      allow-receive-modes = [ receive-modes.fast-forward ] ++ extra-modes;
+    };
+  };
+
+  refs = {
+    master = "refs/heads/master";
+    all-heads = "refs/heads/*";
+  };
+
+in
+commands // receive-modes // permissions // refs