vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Budget only the untrusted write role

e5542ac6b64fa3ebaf62af4831e55996dba45e7e · Keenan Nemetz · 12d ago · parent 9e8cc155

Budget only the untrusted write role

Maintainers and admins are trusted roles: they can already change the
rules, push shared branches and run the instance, so a write budget would
slow their work without bounding anybody who could not do worse. The
budget now applies only below maintain, which is the contribute role and
the read-only accounts that cannot write at all.

The setting is named for what it does: contributor_writes_per_hour. The
role is the effective one on the repository, so an instance-wide
maintainer on a public repository is exempt for the same reason a
repository maintainer is.

docs/configuration.md +1−1

@@ -69,7 +69,7 @@ vole admin account list
	69	69	\| `repo_max_metadata_bytes` \| `33554432` (32 MiB) \| Total size of those files \|
	70	70	\| `repo_max_bytes` \| `5368709120` (5 GiB) \| Git objects in one repository; a repository already over it refuses further pushes \|
	71	71	\| `repo_max_lfs_bytes` \| `10737418240` (10 GiB) \| LFS objects, CI logs and run artifacts in one repository, checked on upload \|
	72		\| `account_writes_per_hour` \| `300` \| Browser writes one account may make in an hour: issues, comments, requests, labels, state changes \|
		72	\| `contributor_writes_per_hour` \| `300` \| Browser writes an untrusted (`contribute`) account may make in an hour: issues, comments, requests, labels, state changes. Maintainers and admins are trusted and are not budgeted \|
	73	73	\| `git_http` \| `true` \| Serve anonymous clone, fetch and LFS downloads over smart HTTP; off leaves SSH as the only transport \|
	74	74	\| `git_http_max_concurrent` \| `16` \| Simultaneous anonymous reads on that transport; past it a clone is refused with `503` and `Retry-After` \|
	75	75	\| `git_http_max_per_client` \| `8` \| Simultaneous reads from one address; `0` leaves only the concurrency bound \|