~ / frieren

 Makefile               | 25 +++++++++++++++++++++++++
 deploy/Caddyfile       |  6 ++++++
 deploy/frieren.service | 30 ++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..a7b96c3
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,25 @@
+VERSION     := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+INSTALL_DIR := $(HOME)/.local/bin
+
+.PHONY: all build install update test clean
+
+all: build install
+
+build:
+	go build -ldflags "-X main.version=$(VERSION)" -o dist/frieren .
+
+install: build
+	mkdir -p $(INSTALL_DIR)
+	install dist/frieren $(INSTALL_DIR)/frieren
+	@case ":$$PATH:" in \
+	  *:"$(INSTALL_DIR)":*) echo "installed $(INSTALL_DIR)/frieren" ;; \
+	  *) echo "installed $(INSTALL_DIR)/frieren — NOTE: $(INSTALL_DIR) is not in your PATH" ;; \
+	esac
+
+update: all
+
+test:
+	go test ./...
+
+clean:
+	rm -rf dist
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..bf4554d
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,6 @@
+# Caddy reverse proxy: automatic HTTPS in front of frieren.
+# Point your domain's DNS at this machine, then `caddy run`.
+
+git.example.com {
+	reverse_proxy 127.0.0.1:7420
+}
diff --git a/deploy/frieren.service b/deploy/frieren.service
new file mode 100644
index 0000000..fc25d5f
--- /dev/null
+++ b/deploy/frieren.service
@@ -0,0 +1,30 @@
+# systemd unit for the machine that hosts frieren.
+#
+#   sudo useradd --system --create-home --home-dir /srv/frieren frieren
+#   sudo install frieren /usr/local/bin/frieren
+#   sudo install -m 600 -o frieren /dev/null /srv/frieren/env
+#   echo "FRIEREN_TOKEN=$(frieren token)" | sudo tee /srv/frieren/env
+#   sudo cp deploy/frieren.service /etc/systemd/system/
+#   sudo systemctl enable --now frieren
+
+[Unit]
+Description=frieren self-hosted git server
+After=network.target
+
+[Service]
+User=frieren
+Group=frieren
+EnvironmentFile=/srv/frieren/env
+ExecStart=/usr/local/bin/frieren serve -addr 127.0.0.1:7420 -root /srv/frieren/repos
+Restart=always
+RestartSec=2
+
+# Hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/srv/frieren/repos
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target