vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 6 is done: sites ride the instance's domain, TLS stays in front

9bea7f110ae780105f9c7c58024a3b67a86d7d7a · Keenan Nemetz · 17d ago · parent d3296cda

Phase 6 is done: sites ride the instance's domain, TLS stays in front

Custom domains and ACME are dropped as non-goals rather than deferred work. An
instance already owns one domain and terminates TLS in front of it, so every
repository's site is a subdomain of that domain and inherits the certificate
that already exists. `pages_domain` remains the only setting.

The operational requirement that falls out of it, documented in the README and
the sample config: the proxy must preserve the Host header, because Host is the
only thing that says which site a request is for.

README.md +18−3

@@ -18,7 +18,7 @@ See [docs/roadmap.md](docs/roadmap.md) for the phased implementation plan.
	18	18
	19	19	## Status
	20	20
	21		Phases 1–5 are implemented. Vole is a working forge: writes go over SSH and are
		21	Phases 1–6 are implemented. Vole is a working forge: writes go over SSH and are
	22	22	authenticated by your key; reads are open.
	23	23
	24	24	Working today:
@@ -59,8 +59,7 @@ Working today:
	59	59	- An instance ed25519 key generated at first boot (used for metadata signing in
	60	60	Phase 7)
	61	61
	62		Not yet: custom site domains and their TLS certificates, workflow artifact uploads,
	63		signature verification, LFS locking.
		62	Not yet: workflow artifact uploads, signature verification, LFS locking.
	64	63
	65	64	## Try it
	66	65
@@ -244,6 +243,22 @@ there is no session for an anonymous reader to authenticate with, so it answers
	244	243	exactly like its clone URL does. Visibility and the branch tip are re-read once a
	245	244	second, so publishing or unpublishing a site takes effect within that window.
	246	245
		246	Sites are subdomains of the instance's own domain, so they ride the certificate you
		247	already have. Terminate TLS in front of `http_addr` and make sure the proxy preserves
		248	the `Host` header — `Host` is the only thing that says which site a request is for:
		249
		250	```nginx
		251	server {
		252	listen 443 ssl;
		253	server_name *.forge.example.com; # the forge and every site
		254	location / {
		255	proxy_set_header Host $host; # required: pages route on it
		256	proxy_set_header X-Forwarded-Proto $scheme;
		257	proxy_pass http://127.0.0.1:8080;
		258	}
		259	}
		260	```
		261
	247	262	## Backup
	248	263
	249	264	Two things, and both are small: