vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Harden sign-in input bounds and private response caching

25343521418945b250da2fb29d27cffe34ee2a6e · Keenan Nemetz · 2d ago · parent b492b557

Harden sign-in input bounds and private response caching

Bound the account name in LoginBegin before it reaches the per-account rate
limiter or the ceremony store, and bound the passkey label and the credential
fields copied from an authenticator. Rate-limit keys are capped by hashing a
long value, forwarding headers used as addresses are capped, and expired limiter
entries are swept as the table grows.

Mark downloads and rendered pages private unless the repository is readable
anonymously. A private repository's artifact, archive, run artifact, raw file,
and HTML pages previously either carried a public cache directive or no
directive at all, so a shared cache could serve them to an anonymous reader.

Refs #209 (01M6S78Y7EQY596Y9TQRSNRVSE).
Refs #210 (01M6S7936QAYM9TMSCXCYP2CF9).

docs/operations.md +5

@@ -224,6 +224,11 @@ the linked sections explain each in full.
	224	224	the `ETag` revalidation that keeps the shared scripts and each Prism grammar to
	225	225	one download per browser. Archives, LFS objects, Git responses and ranged
	226	226	downloads are passed through untouched.
		227	- Shared caches. If a caching proxy or CDN sits in front of the instance, it
		228	may keep public pages, static assets, and artifacts from public repositories.
		229	Private pages and downloads are marked `private` or `no-store`, so a cache that
		230	honours those directives will not serve them to an anonymous reader. Do not
		231	strip or rewrite those headers at the proxy.
	227	232	- SSH firewalled. The SSH listener is the only write transport and the only
	228	233	place an account is authenticated. Expose it to the people who push, not to the
	229	234	internet at large, and leave it on a port other than 22 unless you also run