GOTSH(1)

✨ GOTSH(1) ✨

okay bestie, buckle up, it's the General Commands Manual era and today's main character is gotsh — aka Game of Trees Shell 💅 like yes it has a whole fancy name and yes it is THAT girl.

---

🌸 NAME 🌸

gotsh — Game of Trees Shell 🦋

---

✨ SYNOPSIS ✨

gotsh -c ‘git-receive-pack repository-path’
gotsh -c ‘git-upload-pack repository-path’
gotsh -c ‘weblogin [hostname]’

---

💖 DESCRIPTION 💖

so gotsh is literally the network-facing interface to gotd(8). no cap. it implements the server-side part of the Git network protocol that git(1) and got(1) use. it's giving backend queen 👑

and listen — gotsh is not an interactive shell. not me expecting a prompt 😭. gotsh is meant to be configured as the login shell of Git repository user accounts on servers running gotd(8). if users need a different login shell, gotsh can be installed in the command search path under the names git-receive-pack and git-upload-pack, OR gitwrapper(1) can be used to select the appropriate command to run automatically. options, we love to see it ✨

then users can interact with gotd(8) over the network 🫶. when users invoke commands such as got send and got fetch on client machines, got(1) will connect to the server with ssh(1). gotsh will facilitate communication between gotd(8) running on the server machine and the got(1) or git(1) program running on the client machine. it's giving glue that holds the whole group chat together fr fr.

⚠️ important bestie: users running gotsh should not have access to Git repositories by any means other than accessing the unix socket of gotd(8) via gotsh. that's the vibe check. do not pass go, do not collect repos another way.

the weblogin command provides user authentication for gotwebd(8) 🔐. gotsh will connect to gotwebd(8) and obtain a login URL which allows browsing private repositories the user has been granted read access to in gotwebd.conf(5). if multiple servers are declared in gotwebd.conf(5) the hostname parameter is required and indicates the desired virtual host to use in the URL. if no hostname is specified and only one server is declared in gotwebd.conf(5) then the name of this server will be used in the URL. iconic behaviour honestly 🌈

and it is recommended to restrict ssh(1) features available to users of gotsh. see the “EXAMPLES” section for details. yes there's homework, but it's cute homework 📚🎀

---

🌟 ENVIRONMENT 🌟

• GOTD_UNIX_SOCKET — sets the path to the unix socket which gotd(8) is listening on 🔌. if not specified, the default path /var/run/gotd.sock will be used. defaults, our beloved 💜

---

💅 EXAMPLES 💅

okay this is the part where we actually do stuff, bestie. sshd_config(5) directives such as the following are recommended to protect the server machine and any systems reachable from it, especially if anonymous users are allowed to connect (like, be careful okay 😭):

Match User developer
    DisableForwarding yes
    PermitTTY no

it can be convenient to add all relevant users to a common group, such as “developers”, and then use this group as the Match criteria — group project but make it secure 🫶:

Match Group developers
    DisableForwarding yes
    PermitTTY no

anonymous users can be given public read-only access by using a gotd.conf(5) access rule such as the following:

repository "public" {
        path "/var/git/public.git"
        permit ro anonymous
}

the anonymous user account should have a publicly known password, OR can be set up with an empty password in which case the user's vipw(8) entry would look similar to this example 👀:

anonymous::1002:1002::0:0:Anonymous:/home/anonymous:/usr/local/bin/gotsh

🚨 use of an empty password must be explicitly allowed in sshd_config(5):

Match User anonymous
    PasswordAuthentication yes
    PermitEmptyPasswords yes
    DisableForwarding yes
    PermitTTY no

and to tell security(8) to ignore the empty password, set PASSWDSKIP to the following in /etc/daily.local:

PASSWDSKIP="anonymous:/usr/local/bin/gotsh"

obtain a gotwebd(8) login URL for got.example.com:

$ ssh got.example.com weblogin

if the web server at got.example.com serves virtual hosts then two hostnames must be provided 🫠. one for ssh(1) to connect to, and another to identify the virtual host served by gotwebd(8):

$ ssh got.example.com weblogin got.example.com

in practice both hostnames will often be the same, but this is not guaranteed 😭. there is no reliable way determine the desired virtual host automatically. (yes that's the original wording, no I will not fix it, I respect the source ✨.) an ssh_config(5) entry like the following can save some typing — lazy girlies rise up 💅:

Host weblogin
        Hostname got.example.com
        RemoteCommand weblogin %h

the following command is now equivalent to the above:

$ ssh weblogin

ate. no crumbs. 👑

---

🦋 SEE ALSO 🦋

gitwrapper(1), got(1), ssh(1), gotd.conf(5), gotwebd.conf(5), sshd_config(5), gotd(8), gotwebd(8), security(8)

---

🎀 AUTHORS 🎀

Stefan Sperling <stsp@openbsd.org> — thank you for your service, legend 💜

---

and that's the whole page bestie, we did it 🌈✨ this came to you from the Debian girly, sourced at version $Mdocdate$, and it's officially GOTSH(1) forever and always. mwah 💋 bye pookie 🫶