vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Bound what one repository and one account can cost

9e8cc1553e7b4479e0d9a3d7afd044a0755423ba · Keenan Nemetz · 12d ago · parent 701232cf

Bound what one repository and one account can cost

A repository had no quotas. A contributor could add branches in their own
namespace without limit, any writer could add issues and comments, a
maintainer could add tags, and every page that listed or parsed them grew
with the count. The instance's only answer was an admin deleting things
by hand.

Repository quotas now run in pre-receive, so a refused push moves no
refs, and they describe the repository the push would leave rather than
the one it found:

  repo_max_refs              branches and tags, counted with the refs the
                             push creates and deletes
  repo_max_metadata_entries  documents on the metadata branch: issues,
                             requests, comments, approvals, runs, releases
  repo_max_metadata_bytes    their total size
  repo_max_bytes             git objects on disk; a repository already
                             over it refuses further pushes, so growth is
                             the cap plus one permitted push
  repo_max_lfs_bytes         LFS objects, logs and artifacts, enforced on
                             the upload where the bytes arrive, with 413

The values reach the hook the same way the blob limit does: from the
instance config through the SSH server's environment, so a quota is one
setting rather than a second policy.

Browser writes are budgeted per account (`account_writes_per_hour`, 300).
The limiter is keyed by the account rather than the address, because the
account is what a write is attributed to; a person discussing never
reaches it.

Reads that a repository's own writers control are capped: for-each-ref
listings (branches, tags) return at most 500, while the quota check uses
a count that sees all of them. Activity feeds and state changes were
already bounded.

Open registration's baseline is unchanged (off, role none) and its role
is now restricted to none, read or contribute: a stranger who typed a
name must not be able to move a shared branch or approve a review.

Tests: refs (a new ref is counted, moving one is not), metadata entries
and bytes (a tree with two issues refuses at one, and passes at a
generous limit), repository size, and the LFS quota against a real store;
the transfer refuses a 413 upload over the object cap; the account write
budget; and the registration role refusal.

server/hook/hook.go +14−1

@@ -42,6 +42,16 @@ type Config struct {
	42	42	// LFSWarnBytes flags binaries committed straight into git above this size.
	43	43	// Zero disables the warning.
	44	44	LFSWarnBytes int64
		45	// Quota bounds for this repository. Zero disables the check, which is what a
		46	// test or an offline command wants; the instance always sets them.
		47	MaxRefs int
		48	MaxMetadataEntries int
		49	MaxMetadataBytes int64
		50	MaxRepoBytes int64
		51	MaxLFSBytes int64
		52	// RepoID is the repository's stable id, which is how the LFS store keys its
		53	// links. Empty disables the LFS quota.
		54	RepoID string
	45	55	// AuditPath receives lines about privileged metadata operations. When it is
	46	56	// empty or unwritable, an override is refused and an ordinary push is answered
	47	57	// with a warning: the refs have already moved by the time post-receive runs.
@@ -154,7 +164,10 @@ func PreReceive(cfg Config) int {
	154	164	}
	155	165	}
	156	166	}
	157		var problems []string
		167	// Quotas are checked once, against the repository this push would leave, and
		168	// before any per-ref work: a push that cannot be accepted should say so in one
		169	// line rather than after a page of review findings.
		170	problems := quotaProblems(cfg, g, changes)
	158	171	for _, c := range changes {
	159	172	// Only branches and tags are writable. The namespace beside them used to hold
	160	173	// the ACL; nothing lives there now (see the access package), so it needs no rule