From b89731aabbe92141ebba81270012337a6714e15f Mon Sep 17 00:00:00 2001
From: Nikolay Shaplov <dhyan@nataraj.su>
Date: Sun, 7 Jun 2026 18:43:30 +0000
Subject: [PATCH] Make sure http-git is readonly

---
 conf/nginx/git4ai | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/conf/nginx/git4ai b/conf/nginx/git4ai
index b045aac..a0b8284 100644
--- a/conf/nginx/git4ai
+++ b/conf/nginx/git4ai
@@ -115,6 +115,10 @@ location ~ "^/git4ai[^/]*/([a-zA-Z0-9._-]+)/([a-zA-Z0-9._-]+|-)/([0-9a-f]{4,40}|
 }
 
   location ~ ^/git(/.*) {
+	# Read only repo
+	limit_except GET HEAD {
+		deny all;
+	}
         fastcgi_pass unix:/var/run/fcgiwrap.socket;
         fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
         fastcgi_param GIT_PROJECT_ROOT /var/lib/git;
-- 
2.47.3