vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Replace the git-backed roster with a trusted keys directory

197ecaa29d992ecce2b6078803f3512f565f3672 · Keenan Nemetz · 17d ago · parent a5f19b3c

Replace the git-backed roster with a trusted keys directory

The roster was 476 lines of CAS retries, tree building and snapshot reloading to
store what amounts to username -> authorized_keys lines. Two of the three fields
in meta.json were unused: ACLs key on username, never on id, and nothing ever set
disabled. The git version was paying for history and tamper evidence that
nothing consumed.

Now:

  data/trusted_keys/keenan.keys    # one authorized_keys line per device

This is the AuthorizedKeysFile convention, so ssh-keygen -lf, ansible, rsync and
an editor all work on it, and dropping a key in by hand is a supported way to add
a user because the running instance re-reads the directory every five seconds.
Adds are O_APPEND, so two processes cannot lose each other's writes; removes are
read-modify-rename and assume a single operator. A file that does not parse, or
the same key under two names, still refuses startup rather than silently changing
who can authenticate.

What the directory could not provide on its own is an audit trail, so key changes
append a line to data/audit.log: timestamp, action, user, and key fingerprint.
That is the git log we deleted, at about 15 lines instead of a commit graph. If a
user must be blocked rather than removed, their keys are removed; there is no
disabled flag until something needs one.

Identity is now ~200 lines instead of 476, and the lost-update class of bug that
the CAS loop made possible is gone with the loop.

Verified by hand: fresh init shows data/ only holding audit.log, index.db, repos
and trusted_keys; a key appended to the file by hand starts working within the
poll interval without a restart; removing a key by CLI stops that key
authenticating; audit.log records both.

internal/server/server.go +28−1

@@ -42,10 +42,11 @@ func New(cfg config.Config, binPath string, log slog.Logger) (*Server, error)
	42	42	if err := os.MkdirAll(cfg.ReposDir(), 0o755); err != nil {
	43	43	return nil, err
	44	44	}
	45		ident, err := identity.Open(cfg.SystemRepo())
		45	ident, err := identity.Open(cfg.TrustedKeysDir())
	46	46	if err != nil {
	47	47	return nil, fmt.Errorf("%w\nrun `vole init` to create the instance", err)
	48	48	}
		49	ident.AuditPath = cfg.AuditLog()
	49	50	ix, err := index.Open(cfg.IndexDB())
	50	51	if err != nil {
	51	52	return nil, fmt.Errorf("open index: %w", err)
@@ -146,6 +147,12 @@ func (s *Server) Run(ctx context.Context) error {
	146	147	s.Log.Info("listening", "ssh", sshLn.Addr().String(), "http", httpLn.Addr().String(),
	147	148	"data", s.Cfg.DataDir, "users", len(s.Identity.Snapshot().Users))
	148	149
		150	// The roster is a directory of files, so an operator may edit it directly.
		151	// Polling makes "drop a key in and it works" true without a restart. A
		152	// failed reload keeps the previous snapshot and logs loudly rather than
		153	// locking everyone out over a half-finished edit.
		154	go s.watchRoster(ctx)
		155
	149	156	select {
	150	157	case <-ctx.Done():
	151	158	sh, cancel := context.WithTimeout(context.Background(), 20*time.Second)
@@ -160,6 +167,26 @@ func (s *Server) Run(ctx context.Context) error {
	160	167	}
	161	168	}
	162	169
		170	func (s *Server) watchRoster(ctx context.Context) {
		171	t := time.NewTicker(5 * time.Second)
		172	defer t.Stop()
		173	for {
		174	select {
		175	case <-ctx.Done():
		176	return
		177	case <-t.C:
		178	before := len(s.Identity.Snapshot().ByFingerprint)
		179	if err := s.Identity.Reload(); err != nil {
		180	s.Log.Error("roster reload failed; keeping the previous snapshot", "err", err)
		181	continue
		182	}
		183	if after := len(s.Identity.Snapshot().ByFingerprint); after != before {
		184	s.Log.Info("roster reloaded", "keys", after)
		185	}
		186	}
		187	}
		188	}
		189
	163	190	func (s *Server) Close() error {
	164	191	if s.Index != nil {
	165	192	return s.Index.Close()