server {
    server_name  git.sanders.life ;

    access_log  /var/log/nginx/cgit-access.log;
    error_log   /var/log/nginx/cgit-error.log debug;

    root /usr/share/cgit;
    try_files $uri @cgit;

    # this location block causes the 403
    location @cgit {
        include          fastcgi_params;
        fastcgi_param    SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
        fastcgi_param    DOCUMENT_ROOT   /usr/lib/git-core;
        fastcgi_pass     unix:/run/fcgiwrap.socket;

        fastcgi_param    PATH_INFO    $uri;
        fastcgi_param    QUERY_STRING $args;
        fastcgi_param    HTTP_HOST    $server_name;
	
        fastcgi_param   GIT_HTTP_EXPORT_ALL   "";
        fastcgi_param   GIT_PROJECT_ROOT   /srv/git;
    }

    listen [::]:80 ;
    listen 80 ;
   location / {
    if ($arg_service = git-receive-pack) {
        rewrite (/.*) /git_write/$1 last;
    }

    if ($uri ~ ^/.*/git-receive-pack$) {
        rewrite (/.*) /git_write/$1 last;
    }

    if ($arg_service = git-upload-pack) {
        rewrite (/.*) /git_read/$1 last;
    }

    if ($uri ~ ^/.*/git-upload-pack$) {
        rewrite (/.*) /git_read/$1 last;
    }
  }

location ~ /git_read/(.*) {
    include git-http-backend.conf;
}

# require auth to upload
location ~ /git_write/(.*) {
    auth_basic "Pushing to Git repositories is restricted";
    auth_basic_user_file /etc/nginx/htpasswd;
    include git-http-backend.conf;
}

}