vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add instance-wide roles and refine access UI

5b814e9958090cfd1fa826efb2d375bf613547c1 · Keenan Nemetz · 14d ago · parent 9579c1f9

Add instance-wide roles and refine access UI

Instance roles now live on accounts, apply to public repositories, and the Admin role is the unified instance-admin permission with access to every repository. Repository ACLs can raise an instance role but not lower it.

Adds role assignment to the users UI and CLI, open-registration role config, a reusable role picker, and separates adding a repository account from saving access rules.

forge/config/config.go +14−3

@@ -68,6 +68,11 @@ type Config struct {
	68	68	// Off by default: an instance with no public contribution policy should not
	69	69	// grow accounts just because it is reachable.
	70	70	OpenRegistration bool `toml:"open_registration"`
		71	// OpenRegistrationRole is the instance-wide role a self-registered account
		72	// gets. Empty or "none" preserves the old behaviour: the account has no
		73	// instance grant and only repository defaults apply. The role applies to
		74	// public repositories; "admin" is refused for self-registration.
		75	OpenRegistrationRole string `toml:"open_registration_role"`
	71	76	// InstanceName is what the forge calls itself in the landing page heading and
	72	77	// the page title. Empty uses "Vole".
	73	78	InstanceName string `toml:"instance_name"`
@@ -100,9 +105,10 @@ func defaults() *Config {
	100	105	LFSObjectMaxBytes: 2 << 30, // 2 GiB per LFS object
	101	106	LFSWarnBytes: 5 << 20, // flag binaries over 5 MiB that are not in LFS
	102	107
	103		PagesRef: "pages",
	104		PagesProcs: 4,
	105		PagesCacheBytes: 32 << 20, // 32 MiB holds several 10k-file sites
		108	PagesRef: "pages",
		109	PagesProcs: 4,
		110	PagesCacheBytes: 32 << 20, // 32 MiB holds several 10k-file sites
		111	OpenRegistrationRole: "none",
	106	112	}
	107	113	}
	108	114
@@ -248,6 +254,11 @@ ssh_addr = "127.0.0.1:2222"
	248	254	# Off unless you are running an instance that wants public contributions.
	249	255	# open_registration = true
	250	256
		257	# The instance-wide role a self-registered account gets. It applies to public
		258	# repositories only; an instance admin still has admin access to every
		259	# repository. Use "contribute" for an open-source instance. "admin" is refused.
		260	# open_registration_role = "contribute"
		261
	251	262	# Reject individual blobs above this size (pre-receive). Point people at
	252	263	# git-lfs instead.
	253	264	max_blob_bytes = 104857600