vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Serve repositories from the root of the URL space

ed03b3d1fa16ef6b55e2773aaf10e3be13282c3a · Keenan Nemetz · 4h ago · parent d37d301f

Serve repositories from the root of the URL space

A repository is now /<name> and its Git transport /<name>.git, so the URL a
person opens, the URL a clone uses, and the Go module path are the same name.
The forge's own pages moved under /-/ (admin, accounts, the directory, the
feed, sign-in, assets), a prefix no repository name can start with: names are
[a-z0-9...] and cannot begin with "-". That leaves the router with two disjoint
spaces and removes the /r/ and /git/ prefixes, which existed only to keep
repositories away from the forge's own paths.

Routes: repoRoutes lose /r/; global, auth and admin routes gain /-/; assets
move to /-/static/ because a subtree pattern like /static/ cannot coexist with
one-segment-wildcard repo routes — Go's mux reports them as conflicting
neither-more-specific patterns. The catch-all still renders the styled 404.

Transport: githttp.Route parses /<name>.git/<rest> instead of a /git/ prefix,
and forgepaths.go hands such requests to the proxy before the mux, because a
wildcard fills a whole segment and cannot match "<name>.git". LFS stays on the
mux (<name>.git/info/lfs/...), and the Go module discovery probe moves to the
same pre-router so a package path under a public repository is answered even
when its first segments name a page tab.

Names: repo.ValidateName now refuses the four root paths the forge must keep —
static, robots.txt, sitemap.xml, sitemap-pages.xml. Everything else is an
ordinary repository name, including admin, u, and activity.

Docs and the packaged URLs follow the new layout; robots.txt, the sitemaps and
the instance activity feed point at the new paths. No aliases: the old /r/ and
/git/ URLs are gone.

Verified with ./vole workflow check and ./vole workflow run verify.

server/web/static/auth.js +8−8

@@ -16,11 +16,11 @@
	16	16	async function post(url,body,withCSRF){const h={'Content-Type':'application/json'};if(withCSRF)h['X-Vole-CSRF']=csrf;const r=await fetch(url,{method:'POST',headers:h,body:JSON.stringify(body),credentials:'same-origin'});let d={};try{d=await r.json()}catch(e){}if(!r.ok)throw new Error(d.error\|\|r.statusText);return d}
	17	17	function fail(form,err){const e=form.querySelector('[data-auth-error]')\|\|document.querySelector('[data-auth-error]');if(e)e.textContent=err.message\|\|String(err);else alert(err.message\|\|String(err))}
	18	18	async function signInWithPasskey(form,username,mediation){
	19		const b=await post('/auth/login/begin',username?{username:username}:{});
		19	const b=await post('/-/auth/login/begin',username?{username:username}:{});
	20	20	const opts={publicKey:prepGet(b)};
	21	21	if(mediation)opts.mediation=mediation;
	22	22	const c=await navigator.credentials.get(opts);
	23		await post('/auth/login/finish',resp(c));
		23	await post('/-/auth/login/finish',resp(c));
	24	24	location.href=form.dataset.next\|\|'/';
	25	25	}
	26	26	document.querySelectorAll('form[data-auth]').forEach(function(form){
@@ -34,19 +34,19 @@
	34	34	// server in a request line or a Referer. It is read here and posted.
	35	35	const token=location.hash.replace(/^#/,'');
	36	36	if(!token)throw new Error('This enrollment link is incomplete. Ask an instance admin for a new one.');
	37		const b=await post('/auth/invite/begin',{token:token});
		37	const b=await post('/-/auth/invite/begin',{token:token});
	38	38	const c=await navigator.credentials.create({publicKey:prepCreate(b)});
	39		await post('/auth/invite/finish',resp(c));
		39	await post('/-/auth/invite/finish',resp(c));
	40	40	location.href='/';
	41	41	}else if(form.dataset.auth==='register'){
	42		const b=await post('/auth/register/begin',{username:form.username.value.trim()});
		42	const b=await post('/-/auth/register/begin',{username:form.username.value.trim()});
	43	43	const c=await navigator.credentials.create({publicKey:prepCreate(b)});
	44		await post('/auth/register/finish',resp(c));
		44	await post('/-/auth/register/finish',resp(c));
	45	45	location.href='/';
	46	46	}else if(form.dataset.auth==='passkey'){
	47		const b=await post('/account/passkeys/begin',{label:form.label.value.trim()},true);
		47	const b=await post('/-/account/passkeys/begin',{label:form.label.value.trim()},true);
	48	48	const c=await navigator.credentials.create({publicKey:prepCreate(b)});
	49		await post('/account/passkeys/finish',resp(c),true);
		49	await post('/-/account/passkeys/finish',resp(c),true);
	50	50	location.reload();
	51	51	}
	52	52	}catch(err){fail(form,err);if(btn)btn.disabled=false}