vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Bound what one repository and one account can cost

9e8cc1553e7b4479e0d9a3d7afd044a0755423ba · Keenan Nemetz · 13d ago · parent 701232cf

Bound what one repository and one account can cost

A repository had no quotas. A contributor could add branches in their own
namespace without limit, any writer could add issues and comments, a
maintainer could add tags, and every page that listed or parsed them grew
with the count. The instance's only answer was an admin deleting things
by hand.

Repository quotas now run in pre-receive, so a refused push moves no
refs, and they describe the repository the push would leave rather than
the one it found:

  repo_max_refs              branches and tags, counted with the refs the
                             push creates and deletes
  repo_max_metadata_entries  documents on the metadata branch: issues,
                             requests, comments, approvals, runs, releases
  repo_max_metadata_bytes    their total size
  repo_max_bytes             git objects on disk; a repository already
                             over it refuses further pushes, so growth is
                             the cap plus one permitted push
  repo_max_lfs_bytes         LFS objects, logs and artifacts, enforced on
                             the upload where the bytes arrive, with 413

The values reach the hook the same way the blob limit does: from the
instance config through the SSH server's environment, so a quota is one
setting rather than a second policy.

Browser writes are budgeted per account (`account_writes_per_hour`, 300).
The limiter is keyed by the account rather than the address, because the
account is what a write is attributed to; a person discussing never
reaches it.

Reads that a repository's own writers control are capped: for-each-ref
listings (branches, tags) return at most 500, while the quota check uses
a count that sees all of them. Activity feeds and state changes were
already bounded.

Open registration's baseline is unchanged (off, role none) and its role
is now restricted to none, read or contribute: a stranger who typed a
name must not be able to move a shared branch or approve a review.

Tests: refs (a new ref is counted, moving one is not), metadata entries
and bytes (a tree with two issues refuses at one, and passes at a
generous limit), repository size, and the LFS quota against a real store;
the transfer refuses a 413 upload over the object cap; the account write
budget; and the registration role refusal.

forge/config/config.go +22

@@ -70,6 +70,28 @@ type Config struct {
	70	70	// ReceiveMaxBytes caps a whole push, enforced by git's own
	71	71	// receive.maxInputSize in each repo rather than by buffering in the proxy.
	72	72	ReceiveMaxBytes int64 `toml:"receive_max_bytes"`
		73	// RepoMaxRefs bounds the branches and tags in one repository. A contributor
		74	// can create refs in their own namespace and a maintainer can create tags, so
		75	// without a bound a repository's ref list is a number somebody else chooses —
		76	// and every listing, comparison and activity read walks it.
		77	RepoMaxRefs int `toml:"repo_max_refs"`
		78	// RepoMaxMetadataEntries bounds the files on the metadata branch: issues,
		79	// requests, comments and approvals. Every page load parses them, so this is the
		80	// bound on how slow one repository can make its own pages.
		81	RepoMaxMetadataEntries int `toml:"repo_max_metadata_entries"`
		82	// RepoMaxMetadataBytes bounds the total size of those files.
		83	RepoMaxMetadataBytes int64 `toml:"repo_max_metadata_bytes"`
		84	// RepoMaxBytes bounds a repository's on-disk objects. A push that would leave
		85	// the repository over this is refused, so the growth of a repository is bounded
		86	// by the cap plus one permitted push.
		87	RepoMaxBytes int64 `toml:"repo_max_bytes"`
		88	// RepoMaxLFSBytes bounds one repository's LFS objects, CI logs and run
		89	// artifacts. It is enforced where the bytes arrive, on the upload.
		90	RepoMaxLFSBytes int64 `toml:"repo_max_lfs_bytes"`
		91	// AccountWritesPerHour bounds how many repository writes one account may make
		92	// from the browser: issues, comments, requests, labels, state changes. A person
		93	// writing discussion never comes near it; a script posting in a loop does.
		94	AccountWritesPerHour int `toml:"account_writes_per_hour"`
	73	95	// LFSObjectMaxBytes caps a single LFS object.
	74	96	LFSObjectMaxBytes int64 `toml:"lfs_object_max_bytes"`
	75	97	// LFSWarnBytes makes a push that commits a binary larger than this carry a