vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Let instance admins read every repository

381d6aac38ab785d879fa82a6b8397ce6f543bab · Keenan Nemetz · 14d ago · parent 074ae160

Let instance admins read every repository

An instance administrator can already rewrite any repository's ACL, so hiding its content only hides what they govern. Raise them to at least read in the web and SSH paths, preserving any higher explicit role, and enforce the read rule on SSH upload-pack, where any authenticated key could previously clone a private repository by name. Anonymous HTTP clone still answers 404 because it carries no identity.

Group the admin surface into Repositories and Users tabs with a shared header, and teach Page.Section to mark the active tab.

docs/users-and-access.md +6

@@ -112,6 +112,12 @@ manage that repository's branches and reviews; an instance admin can create user
	112	112	and repositories and change access rules anywhere. Only instance admins may use
	113	113	`--remote`.
	114	114
		115	Instance admins may also browse and clone any repository, private ones included,
		116	without an ACL entry of their own. That overlay is read-only: it does not grant
		117	push, comment, or repository-settings rights, which still need the matching ACL
		118	role. SSH Git and SSH LFS use the key's account for this check; anonymous HTTP
		119	clone has no identity, so a private repository still answers `404` there.
		120
	115	121	Instance admins also get an Admin section in the browser. It covers
	116	122	repository creation and per-repository access rules, plus accounts: create an
	117	123	account from an enrollment link, grant or revoke instance admin, retire an