Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Publish repositories as Go modules and move the module path to rodent.software

d37d301fd4881ee37855387377db5a7aed843017 · Keenan Nemetz · 17h ago · parent 1c363d53 

Publish repositories as Go modules and move the module path to rodent.software

The module named a GitHub repository that does not exist, and a module path
under the forge could not be fetched anyway: the go command resolves an import
path by asking it for a go-import tag first, and the forge served only pages.

Answer the <host>/<repository> discovery probe from the catch-all route with the
repository's tag, naming its Git transport and that prefix, so a public
repository is importable with no vanity service in front of the instance. Only
a repository an anonymous reader can read answers: the tag is fetched without
credentials, so a tag for a private repository would confirm its existence to
anyone who guessed the name. The prefix host comes from public_url, never the
request's Host header, for the same reason the clone URL does.

With the path resolvable, rename the module to rodent.software/vole: imports,
the build line in the getting-started guide, and the packaged units and
metadata follow it. docs/go-modules.md explains the lookup, what the instance
must have, and why a repository named after a route cannot claim the prefix.

docs/configuration.md +4

@@ -298,6 +298,10 @@ created. It is also the WebAuthn relying-party origin: browser sign-in is enable
298 298 only when `public_url` is an `https://` URL. Vole does not change how it routes
299 299 requests based on this setting.
300 300
301 The host name in `public_url` is also the import prefix a Go module path uses:
302 `public_url = "https://forge.example.com"` publishes a public repository as
303 `forge.example.com/<repository>`. See [Go modules](go-modules.md).
304
301 305 It is also where generated clone and LFS download links point. That is a security
302 306 property, not a convenience: without it those links follow the request's `Host`
303 307 header, which is a value the browser's request carries and an attacker can choose.