vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Let remote admin create a bot account

338a19dd7e42c2bf42c206318197f4b53c3e9fd7 · Keenan Nemetz · 6d ago · parent 70291860

docs/runner.md +36

@@ -30,6 +30,42 @@ vole runner --remote ssh://git@host:2222 --repos demo --repos docs
	30	30	- `--once` leases one job and exits, which is useful for a runner that is
	31	31	scheduled per job.
	32	32
		33	## The runner's account
		34
		35	A runner connects as an account, and that account is the runner's identity: it is
		36	what the repository's runner allowlist names, what the audit log records, and what
		37	the server checks before it hands over a job. For a machine nobody signs in to,
		38	make the account a bot:
		39
		40	```sh
		41	vole admin account create ci-runner-1 --bot --key ci-runner-1.pub
		42	vole admin acl runners add demo ci-runner-1
		43	vole admin acl set-role demo ci-runner-1 read # private repositories only
		44	```
		45
		46	From another machine, name the instance; the key file is read where the command
		47	runs:
		48
		49	```sh
		50	vole admin --remote ssh://git@host:2222 account create ci-runner-1 --bot --key ci-runner-1.pub
		51	```
		52
		53	A bot has no browser sign-in, so its key cannot be turned into a web session, and
		54	it cannot be an instance admin. That second part matters for a runner: admins
		55	count as trusted reporters even when a repository's allowlist does not name them,
		56	so an admin account would make every result count and quietly bypass the list. A
		57	named runner needs no repository role for its result to count — the allowlist is
		58	that decision — but the build still has to clone the code, and a private
		59	repository grants no read role by default. The `set-role ... read` line covers the
		60	clone without giving the machine write access.
		61
		62	The `--key` is long-lived: it authenticates the runner process for as long as the
		63	account is active. It is not the credential a job uses. A workflow job that names
		64	a bot with `bot:` still gets a key minted for that run, scoped to the repository
		65	and the run, and gone when the run ends; that key cannot lease work. Keep one key
		66	per runner machine, readable only by the runner user, so a host you stop trusting
		67	is revoked by removing that key or retiring the account.
		68
	33	69	## Host key verification
	34	70
	35	71	A runner executes repository code, so the instance it trusts is a security