vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Code

392 commit(s) on main

Compare History

Merge change request 01M70WES5ZZDJ6RP226WB11BBZ: Let people rename and remove their own passkeys keenan · 1h ago 4b8c9e1d

history blame raw 2.6 KiB

1	[Unit]
2	Description=Vole software forge
3	Documentation=https://rodent.software/vole
4	After=network-online.target
5	Wants=network-online.target
6
7	[Service]
8	Type=simple
9	User=vole
10	Group=vole
11	ExecStart=/usr/bin/vole serve --config /etc/vole/vole.toml
12	Restart=on-failure
13	RestartSec=2s
14
15	# A clean stop stops handing out jobs and gives the ones already leased up to a
16	# minute to report, then closes the HTTP listeners with a 20 second budget. Leave
17	# room above both so systemd does not kill the drain early.
18	TimeoutStopSec=100s
19
20	# Everything the service creates is group-readable at most: 0027 gives the
21	# service account rw, the vole group r, and everybody else nothing. Vole creates
22	# its own secrets at 0600 regardless, but a umask is what covers the files git,
23	# sqlite and the ACME client create on its behalf.
24	UMask=0027
25
26	# The instance lives in /var/lib/vole. systemd creates and owns it, and with
27	# ProtectSystem=strict it is the only writable directory the service gets.
28	StateDirectory=vole
29	StateDirectoryMode=0750
30	ConfigurationDirectory=vole
31
32	# Vole runs git for every push and read, so a busy instance has many children.
33	LimitNOFILE=65536
34
35	# A core dump of this process is a copy of the SSH host key, the roster and any
36	# private key in memory.
37	LimitCORE=0
38
39	# No capabilities at all. The SSH listener is 2222 in the packaged config; to
40	# serve SSH or automatic HTTPS on a port below 1024, a drop-in must re-grant the
41	# one capability that needs, which means adding it here as well:
42	#
43	# [Service]
44	# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
45	# AmbientCapabilities=CAP_NET_BIND_SERVICE
46	CapabilityBoundingSet=
47
48	NoNewPrivileges=true
49	PrivateTmp=true
50	PrivateDevices=true
51	ProtectSystem=strict
52	ProtectHome=true
53	ProtectClock=true
54	ProtectHostname=true
55	ProtectKernelTunables=true
56	ProtectKernelModules=true
57	ProtectKernelLogs=true
58	ProtectControlGroups=true
59	RestrictNamespaces=true
60	RestrictRealtime=true
61	RestrictSUIDSGID=true
62	LockPersonality=true
63	SystemCallArchitectures=native
64	RemoveIPC=true
65
66	# AF_NETLINK is not a network client: libc reads interface and address changes
67	# through it. Everything the forge needs to reach is unix sockets, TCP and UDP.
68	RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
69
70	# Other processes' command lines, environment and file descriptors are not this
71	# service's business, and a git child does not need to see them.
72	ProtectProc=invisible
73	ProcSubset=pid
74
75	# Go does not generate code at run time. The container runtime a CI runner needs
76	# runs in the runner's own unit, not here, so nothing in this process wants a
77	# writable-and-executable mapping.
78	MemoryDenyWriteExecute=true
79
80	[Install]
81	WantedBy=multi-user.target
82