vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 1: a working git remote with access control

653e0cfc227c992e5b26ea10057aa0b424b6ce4f · Keenan Nemetz · 18d ago · parent c5626f1b

Phase 1: a working git remote with access control

Vole is now a functioning forge foundation: one CGO-free binary that serves
real git over smart HTTP and enforces per-repo policy in pre-receive.

What is in:

- internal/transport drives `git http-backend` as a CGI subprocess. Chunked
  uploads are spooled to learn CONTENT_LENGTH (git's default client config
  produces them), spool files are cleaned on error and abort, and a janitor
  sweeps anything a crash left behind. Pushes are capped by size and
  serialised behind a semaphore, because Phase 0 measured 1.13 GB of git RSS
  for a single 1 GiB push.
- internal/acl stores roles on refs/vole/acl inside each repository, so
  access rules travel with a clone. One evaluation function is shared by the
  hook and the web layer.
- internal/hook enforces policy in pre-receive: authentication, write role,
  protected refs, per-blob size limits, and a refusal to accept pushes to
  refs/vole/* - without that last check a writer could push their own
  acl.json and grant themselves admin.
- internal/auth holds users, personal access tokens and web sessions in
  SQLite. Passwords use PBKDF2-SHA256; tokens are 256-bit random values and
  are stored as SHA-256 hashes, since there is no low-entropy secret to grind.
- internal/index is the derived read model, rebuildable from disk and refs.
- internal/repo owns the bare-repo store and the metadata ref CAS helper.
- internal/web is the browse surface: repo list, tree, blob, raw, history,
  login, and per-repo settings for access rules, rename and delete.
- internal/signing creates the instance ed25519 key at first boot for the
  Phase 7 work.

Every Phase 1 exit criterion has a test that would fail if it regressed:
clone/push against a real listener, read-only and anonymous rejection with the
ref proven unmoved, rebuild-from-refs compared against the actual acl ref, a
spool file proven absent after an aborted chunked upload, and two pushes
completing through a single-slot semaphore. scripts/ci.sh runs gofmt, vet,
build, a markdown link check and the race-enabled suite.

Verified by hand as well: a clean `vole init` -> user -> token -> push ->
clone cycle, web login and browse, and a 256 MiB chunked push killed
mid-flight leaving no ref, no spool file and no orphaned git processes.

internal/index/index.go +169

@@ -0,0 +1,169 @@
	1	// Package index holds the derived read model. Everything in it can be thrown
	2	// away and rebuilt from the repos on disk, which is why it is safe for it to be
	3	// the layer that knows about SQL.
	4	package index
	5
	6	import (
	7	"database/sql"
	8	"errors"
	9	"fmt"
	10	"time"
	11
	12	_ "modernc.org/sqlite"
	13
	14	"github.com/rodent-software/vole/internal/repo"
	15	)
	16
	17	type Entry struct {
	18	ID string
	19	Name string
	20	Description string
	21	DefaultBranch string
	22	Created time.Time
	23	ACLSHA string
	24	ACLPrincipals int
	25	ACLDefault string
	26	}
	27
	28	type Store struct{ db *sql.DB }
	29
	30	func Open(path string) (*Store, error) {
	31	dsn := path + "?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)"
	32	db, err := sql.Open("sqlite", dsn)
	33	if err != nil {
	34	return nil, err
	35	}
	36	db.SetMaxOpenConns(4)
	37	s := &Store{db: db}
	38	if _, err := db.Exec(`
	39	CREATE TABLE IF NOT EXISTS repos (
	40	id TEXT PRIMARY KEY,
	41	name TEXT NOT NULL UNIQUE,
	42	description TEXT NOT NULL DEFAULT '',
	43	default_branch TEXT NOT NULL DEFAULT 'main',
	44	created INTEGER NOT NULL,
	45	acl_sha TEXT NOT NULL DEFAULT '',
	46	acl_principals INTEGER NOT NULL DEFAULT 0,
	47	acl_default TEXT NOT NULL DEFAULT 'none'
	48	);`); err != nil {
	49	db.Close()
	50	return nil, err
	51	}
	52	return s, nil
	53	}
	54
	55	func (s *Store) Close() error { return s.db.Close() }
	56
	57	// Rebuild discards the index and reconstructs it from the repo store. This is
	58	// the operation that proves the index is derived and not authoritative.
	59	func (s Store) Rebuild(st repo.Store) (int, error) {
	60	repos, err := st.List()
	61	if err != nil {
	62	return 0, err
	63	}
	64	tx, err := s.db.Begin()
	65	if err != nil {
	66	return 0, err
	67	}
	68	defer tx.Rollback()
	69	if _, err := tx.Exec(`DELETE FROM repos`); err != nil {
	70	return 0, err
	71	}
	72	for _, m := range repos {
	73	e, err := entryFor(m)
	74	if err != nil {
	75	return 0, err
	76	}
	77	if err := insert(tx, e); err != nil {
	78	return 0, err
	79	}
	80	}
	81	if err := tx.Commit(); err != nil {
	82	return 0, err
	83	}
	84	return len(repos), nil
	85	}
	86
	87	// Upsert refreshes one repo without a full rebuild.
	88	func (s Store) Upsert(m repo.Meta) error {
	89	e, err := entryFor(m)
	90	if err != nil {
	91	return err
	92	}
	93	return insert(s.db, e)
	94	}
	95
	96	func (s *Store) Remove(id string) error {
	97	_, err := s.db.Exec(`DELETE FROM repos WHERE id=?`, id)
	98	return err
	99	}
	100
	101	func (s *Store) List() ([]Entry, error) {
	102	rows, err := s.db.Query(`SELECT id, name, description, default_branch, created, acl_sha, acl_principals, acl_default FROM repos ORDER BY name`)
	103	if err != nil {
	104	return nil, err
	105	}
	106	defer rows.Close()
	107	var out []Entry
	108	for rows.Next() {
	109	var e Entry
	110	var created int64
	111	if err := rows.Scan(&e.ID, &e.Name, &e.Description, &e.DefaultBranch, &created, &e.ACLSHA, &e.ACLPrincipals, &e.ACLDefault); err != nil {
	112	return nil, err
	113	}
	114	e.Created = time.Unix(created, 0).UTC()
	115	out = append(out, e)
	116	}
	117	return out, rows.Err()
	118	}
	119
	120	func (s Store) Get(name string) (Entry, error) {
	121	var e Entry
	122	var created int64
	123	err := s.db.QueryRow(`SELECT id, name, description, default_branch, created, acl_sha, acl_principals, acl_default FROM repos WHERE name=?`, name).
	124	Scan(&e.ID, &e.Name, &e.Description, &e.DefaultBranch, &created, &e.ACLSHA, &e.ACLPrincipals, &e.ACLDefault)
	125	if errors.Is(err, sql.ErrNoRows) {
	126	return nil, osErrNotExist
	127	}
	128	if err != nil {
	129	return nil, err
	130	}
	131	e.Created = time.Unix(created, 0).UTC()
	132	return &e, nil
	133	}
	134
	135	var osErrNotExist = fmt.Errorf("index: repo not found")
	136
	137	func entryFor(m *repo.Meta) (Entry, error) {
	138	e := Entry{
	139	ID: m.ID,
	140	Name: m.Name,
	141	Description: m.Description,
	142	DefaultBranch: m.DefaultBranch,
	143	Created: m.Created,
	144	}
	145	a, err := m.ACL()
	146	if err != nil {
	147	return e, err
	148	}
	149	e.ACLDefault = a.Default
	150	e.ACLPrincipals = len(a.Entries)
	151	if sha, err := m.Git().RevParse(repo.ACLRef); err == nil {
	152	e.ACLSHA = sha
	153	}
	154	return e, nil
	155	}
	156
	157	type execer interface {
	158	Exec(query string, args ...any) (sql.Result, error)
	159	}
	160
	161	func insert(x execer, e Entry) error {
	162	_, err := x.Exec(`INSERT INTO repos(id, name, description, default_branch, created, acl_sha, acl_principals, acl_default)
	163	VALUES(?,?,?,?,?,?,?,?)
	164	ON CONFLICT(id) DO UPDATE SET
	165	name=excluded.name, description=excluded.description, default_branch=excluded.default_branch,
	166	acl_sha=excluded.acl_sha, acl_principals=excluded.acl_principals, acl_default=excluded.acl_default`,
	167	e.ID, e.Name, e.Description, e.DefaultBranch, e.Created.Unix(), e.ACLSHA, e.ACLPrincipals, e.ACLDefault)
	168	return err
	169	}