Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Code

392 commit(s) on main

Compare History
Merge change request 01M70WES5ZZDJ6RP226WB11BBZ: Let people rename and remove their own passkeys keenan · 25m ago 4b8c9e1d
history blame raw 5.3 KiB
1#cloud-config
2# A Vole instance on a fresh Ubuntu or Debian machine, ready in a few minutes.
3#
4# Each placeholder below is a value the caller supplies, and render.sh fills them
5# in: a placeholder is a dollar sign followed by a name in braces, so shell
6# variables in the script at the bottom are written without braces and are left
7# alone. scripts/check-deploy.py renders this file the same way to check it.
8#
9# What this file does, in order: cloud-init installs git and curl, writes the
10# configuration and the admin's SSH key to /opt/vole-deploy, then runs
11# vole-first-boot, which installs the package, puts the configuration in place,
12# creates the instance admin, and starts the service. Nothing here is specific to
13# a cloud provider; see docs/deploy/ for which machine to give it to.
14
15hostname: ${hostname}
16fqdn: ${hostname}
17manage_etc_hosts: true
18
19package_update: true
20packages:
21 - git
22 - ca-certificates
23 - curl
24
25write_files:
26 # Two configurations are staged and the boot script installs the one that
27 # ${tls_mode} names: "acme" lets Vole obtain its own certificate, "proxy"
28 # expects a TLS proxy in front. Editing the installed /etc/vole/vole.toml is
29 # the normal way to change either afterwards.
30 - path: /opt/vole-deploy/vole.acme.toml
31 permissions: "0644"
32 content: |
33 # Written by cloud-init. This is the whole configuration; see
34 # docs/configuration.md for every setting.
35 data_dir = "/var/lib/vole/data"
36
37 # Vole obtains and renews its own TLS certificate, so no proxy is needed.
38 # Port 80 answers the certificate challenge and redirects to HTTPS.
39 http_addr = ":80"
40 https_addr = ":443"
41 public_url = "https://${hostname}"
42 acme_email = "${admin_email}"
43
44 # The only write transport: Git over SSH, authenticated by key.
45 ssh_addr = "0.0.0.0:2222"
46
47 instance_name = "${instance_name}"
48
49 - path: /opt/vole-deploy/vole.proxy.toml
50 permissions: "0644"
51 content: |
52 # Written by cloud-init. This is the whole configuration; see
53 # docs/configuration.md for every setting.
54 data_dir = "/var/lib/vole/data"
55
56 # Nothing terminates TLS here. Put a proxy in front that keeps the Host
57 # header and forwards the client address, then uncomment the last line.
58 http_addr = "127.0.0.1:8080"
59 public_url = "https://${hostname}"
60 # git_http_client_ip_header = "X-Forwarded-For"
61
62 # The only write transport: Git over SSH, authenticated by key.
63 ssh_addr = "0.0.0.0:2222"
64
65 instance_name = "${instance_name}"
66
67 # Ports below 1024 need one capability from the hardened unit. Only the ACME
68 # configuration binds one.
69 - path: /opt/vole-deploy/bind.conf
70 permissions: "0644"
71 content: |
72 [Service]
73 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
74 AmbientCapabilities=CAP_NET_BIND_SERVICE
75
76 # The first account, and an instance admin. A public key is not a secret, so
77 # this stays readable; the account keeps its own copy in users.db.
78 - path: /opt/vole-deploy/admin.pub
79 permissions: "0644"
80 content: |
81 ${admin_ssh_key}
82
83 - path: /usr/local/sbin/vole-first-boot
84 permissions: "0755"
85 content: |
86 #!/bin/sh
87 # One-time setup for a Vole instance. cloud-init runs this once, on first
88 # boot. It is safe to run again: the package install is skipped when vole
89 # is already there, and the account is only created if it does not exist.
90 set -eu
91
92 ADMIN='${admin_account}'
93 PACKAGE_URL='${vole_package_url}'
94 TLS_MODE='${tls_mode}'
95 LOG=/var/log/vole-first-boot.log
96
97 exec >>"$LOG" 2>&1
98 echo "== vole first boot $(date -u +%Y-%m-%dT%H:%M:%SZ) =="
99
100 # The package creates the service account, /var/lib/vole, and the database
101 # and repository tree the shipped config names. Installing it before the
102 # configuration is written means the shipped conffile is replaced on
103 # purpose, which is the documented way to configure an instance.
104 if ! command -v vole >/dev/null 2>&1; then
105 echo "downloading $PACKAGE_URL"
106 curl -fsSL --retry 5 --retry-delay 2 -o /opt/vole-deploy/vole.deb "$PACKAGE_URL"
107 DEBIAN_FRONTEND=noninteractive apt-get install -y /opt/vole-deploy/vole.deb
108 rm -f /opt/vole-deploy/vole.deb
109 fi
110
111 install -m 0644 "/opt/vole-deploy/vole.$TLS_MODE.toml" /etc/vole/vole.toml
112 if [ "$TLS_MODE" = "acme" ]; then
113 install -d -m 0755 /etc/systemd/system/vole.service.d
114 install -m 0644 /opt/vole-deploy/bind.conf /etc/systemd/system/vole.service.d/bind.conf
115 fi
116 systemctl daemon-reload
117
118 # An account name is permanent, so this creates it once and leaves it alone
119 # on a later run.
120 if su -s /bin/sh vole -c "vole admin --config /etc/vole/vole.toml account show '$ADMIN'" >/dev/null 2>&1; then
121 echo "account $ADMIN already exists"
122 else
123 su -s /bin/sh vole -c "vole admin --config /etc/vole/vole.toml account create '$ADMIN' --key /opt/vole-deploy/admin.pub --role admin"
124 fi
125
126 systemctl enable --now vole
127 echo "vole is running on https://${hostname}"
128
129runcmd:
130 - /usr/local/sbin/vole-first-boot
131
132final_message: >-
133 Vole is up. Open https://${hostname} to sign in, or clone
134 ssh://git@${hostname}:2222/ once you have created a repository. Setup output is
135 in /var/log/vole-first-boot.log.
136