vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Accounts with stable ids; the roster moves into the system repository
31df8baea9c9e8acf74b71bdda26d27907b30f2a · Keenan Nemetz · 17d ago · parent 36293228
Accounts with stable ids; the roster moves into the system repository
Names were the primary key everywhere — the keys file name, the ACL entry, the
approval file — so renaming someone broke their access, orphaned their approvals,
and left a retired name able to hand a newcomer the old holder's rights. This
splits identity into an account (stable id, anchored by its SSH keys) and a name
(mutable, never reissued).
data/system.git refs/heads/main
users/<ulid>/meta.json name, status, keys, former_names
Everything that grants authority now holds the id: ACL entries, approval files,
and the identity resolved at the SSH handshake (VOLE_ACTOR_ID). A rename is a
one-file change that disturbs nothing else, and both the old and new names stay
reserved forever.
The roster moved from a trusted-keys directory back into git, which reverses an
earlier simplification — deliberately, and in a smaller shape (one file per
account, one writer, no CAS plumbing for unused fields). Git buys what a directory
could not: `git log` answers who renamed whom and when a key appeared, and the
roster is now readable by anyone who can clone, since it is served read-only at
ssh://host/system.git. `vole request new` and `approve` use exactly that to turn a
name typed on the command line into the account id they store.
Two latent bugs surfaced, both caught by tests added here:
- gitx inherited git's repository-scoped environment. pre-receive runs with
GIT_OBJECT_DIRECTORY and GIT_QUARANTINE_PATH pointing at the pushed repository's
quarantine, so every git call a hook made for a *different* repository silently
read the pushed one: the hook saw an empty roster. gitx now scrubs those
variables and the hook restores them for the pushed repository only.
- The hook built the repository name with filepath.Base on receive-pack's path,
which carries a trailing separator, so refusals read "does not have write access
to .". Cleaned first.
Verified end to end on a live instance: two accounts file, approve and land a
change; `vole user rename wilbur robert` keeps the same key's write access and the
approval still reads as current, now credited to robert; the roster history shows
"user: rename wilbur to robert"; retiring an account rejects its key within five
seconds and refuses to reissue the name.
internal/server/server.go +6−6
| @@ -42,7 +42,7 @@ func New(cfg *config.Config, binPath string, log *slog.Logger) (*Server, error) | |||
| 42 | 42 | if err := os.MkdirAll(cfg.ReposDir(), 0o755); err != nil { | |
| 43 | 43 | return nil, err | |
| 44 | 44 | } | |
| 45 | ident, err := identity.Open(cfg.TrustedKeysDir()) | ||
| 45 | ident, err := identity.Open(cfg.SystemRepo()) | ||
| 46 | 46 | if err != nil { | |
| 47 | 47 | return nil, fmt.Errorf("%w\nrun `vole init` to create the instance", err) | |
| 48 | 48 | } | |
| @@ -79,7 +79,7 @@ func New(cfg *config.Config, binPath string, log *slog.Logger) (*Server, error) | |||
| 79 | 79 | if err != nil { | |
| 80 | 80 | return nil, fmt.Errorf("ssh: %w", err) | |
| 81 | 81 | } | |
| 82 | wp, err := web.New(rs, ix, cfg) | ||
| 82 | wp, err := web.New(rs, ix, ident, cfg) | ||
| 83 | 83 | if err != nil { | |
| 84 | 84 | return nil, err | |
| 85 | 85 | } | |
| @@ -110,7 +110,7 @@ func (s *Server) routes() *http.ServeMux { | |||
| 110 | 110 | ||
| 111 | 111 | mux.HandleFunc("GET /healthz", func(rw http.ResponseWriter, r *http.Request) { | |
| 112 | 112 | rw.Header().Set("Content-Type", "text/plain") | |
| 113 | fmt.Fprintf(rw, "ok\nkey=%s\nusers=%d\n", s.Key.Fingerprint(), len(s.Identity.Snapshot().Users)) | ||
| 113 | fmt.Fprintf(rw, "ok\nkey=%s\nusers=%d\n", s.Key.Fingerprint(), s.Identity.Snapshot().Count) | ||
| 114 | 114 | }) | |
| 115 | 115 | ||
| 116 | 116 | // Anonymous, read-only git. Registered without a method so git's POSTs reach it. | |
| @@ -150,7 +150,7 @@ func (s *Server) Run(ctx context.Context) error { | |||
| 150 | 150 | }() | |
| 151 | 151 | ||
| 152 | 152 | s.Log.Info("listening", "ssh", sshLn.Addr().String(), "http", httpLn.Addr().String(), | |
| 153 | "data", s.Cfg.DataDir, "users", len(s.Identity.Snapshot().Users)) | ||
| 153 | "data", s.Cfg.DataDir, "users", s.Identity.Snapshot().Count) | ||
| 154 | 154 | ||
| 155 | 155 | // The roster is a directory of files, so an operator may edit it directly. | |
| 156 | 156 | // Polling makes "drop a key in and it works" true without a restart. A | |
| @@ -180,12 +180,12 @@ func (s *Server) watchRoster(ctx context.Context) { | |||
| 180 | 180 | case <-ctx.Done(): | |
| 181 | 181 | return | |
| 182 | 182 | case <-t.C: | |
| 183 | before := len(s.Identity.Snapshot().ByFingerprint) | ||
| 183 | before := s.Identity.Snapshot().Count | ||
| 184 | 184 | if err := s.Identity.Reload(); err != nil { | |
| 185 | 185 | s.Log.Error("roster reload failed; keeping the previous snapshot", "err", err) | |
| 186 | 186 | continue | |
| 187 | 187 | } | |
| 188 | if after := len(s.Identity.Snapshot().ByFingerprint); after != before { | ||
| 188 | if after := s.Identity.Snapshot().Count; after != before { | ||
| 189 | 189 | s.Log.Info("roster reloaded", "keys", after) | |
| 190 | 190 | } | |
| 191 | 191 | } | |