vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add browser auth, contributor access, and gated CI

6c84d387e5f608360e30484a1a5b1cff41076850 · Keenan Nemetz · 16d ago · parent c36d5073

Add browser auth, contributor access, and gated CI

Browser sign-in now uses passkeys. Enrollment links are one-time, sessions are hashed in users.db, and issue/comment/approval writes use the session account. HTTPS public_url is required for WebAuthn.

Add the contributor role between read and maintain. Contributors can discuss and open change requests, and may push only refs/heads/contrib/<account-id>/. Contributor CI is held per commit until a maintainer allows the exact tip from the repository page.

Rename the write role to maintain. write remains accepted as the historical spelling, and access.Write remains as a Go alias so existing callers and ACL rows keep working.

Update the web, CLI, queue schema, and guides for the new flows, and cover the role, namespace, auth, and CI-gating paths in tests.

README.md +10

@@ -17,6 +17,8 @@ you do not own.
	17	17	a box in the closet.
	18	18	- It is easy to run. One binary, one config file, and no extra services to
	19	19	operate. You do not need a cloud account to get started.
		20	- Browser sign-in without passwords. People who file issues can enroll a
		21	passkey from a one-time link; there is no password database to protect.
	20	22	- Admins can work from anywhere. Instance admins can create users,
	21	23	repositories, and access rules over the same SSH connection, from any machine.
	22	24	- It is small on purpose. Fewer moving parts, fewer things to break, and a
@@ -48,6 +50,14 @@ git clone ssh://git@127.0.0.1:2222/demo.git # read/write, key required
	48	50	git clone http://127.0.0.1:8080/git/demo.git # read only, no credentials
	49	51	```
	50	52
		53	To let people file issues and approve changes in a browser, set `public_url` to
		54	the instance's `https://` address, then create an account and its enrollment
		55	link:
		56
		57	```sh
		58	vole admin user create reporter
		59	```
		60
	51	61	New repositories are private. If someone opens a private repository on the web,
	52	62	they get a `404` — the same answer as a repository that does not exist — so Vole
	53	63	never confirms that it is there.