vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Bound what one repository and one account can cost

9e8cc1553e7b4479e0d9a3d7afd044a0755423ba · Keenan Nemetz · 13d ago · parent 701232cf

Bound what one repository and one account can cost

A repository had no quotas. A contributor could add branches in their own
namespace without limit, any writer could add issues and comments, a
maintainer could add tags, and every page that listed or parsed them grew
with the count. The instance's only answer was an admin deleting things
by hand.

Repository quotas now run in pre-receive, so a refused push moves no
refs, and they describe the repository the push would leave rather than
the one it found:

  repo_max_refs              branches and tags, counted with the refs the
                             push creates and deletes
  repo_max_metadata_entries  documents on the metadata branch: issues,
                             requests, comments, approvals, runs, releases
  repo_max_metadata_bytes    their total size
  repo_max_bytes             git objects on disk; a repository already
                             over it refuses further pushes, so growth is
                             the cap plus one permitted push
  repo_max_lfs_bytes         LFS objects, logs and artifacts, enforced on
                             the upload where the bytes arrive, with 413

The values reach the hook the same way the blob limit does: from the
instance config through the SSH server's environment, so a quota is one
setting rather than a second policy.

Browser writes are budgeted per account (`account_writes_per_hour`, 300).
The limiter is keyed by the account rather than the address, because the
account is what a write is attributed to; a person discussing never
reaches it.

Reads that a repository's own writers control are capped: for-each-ref
listings (branches, tags) return at most 500, while the quota check uses
a count that sees all of them. Activity feeds and state changes were
already bounded.

Open registration's baseline is unchanged (off, role none) and its role
is now restricted to none, read or contribute: a stranger who typed a
name must not be able to move a shared branch or approve a review.

Tests: refs (a new ref is counted, moving one is not), metadata entries
and bytes (a tree with two issues refuses at one, and passes at a
generous limit), repository size, and the LFS quota against a real store;
the transfer refuses a 413 upload over the object cap; the account write
budget; and the registration role refusal.

forge/config/validate.go +19−3

@@ -105,10 +105,14 @@ func (c *Config) Validate() error {
	105	105	}
	106	106	if role := strings.TrimSpace(c.OpenRegistrationRole); role != "" {
	107	107	r, err := access.ParseRole(role)
	108		if err != nil {
		108	switch {
		109	case err != nil:
	109	110	add("open_registration_role: %v", err)
	110		} else if r.AtLeast(access.Admin) {
	111		add("open_registration_role must not be %q: self-registration cannot grant instance administration", role)
		111	case r.AtLeast(access.Maintain):
		112	// Anyone may sign up on an instance that opened registration; moving
		113	// shared branches and approving reviews is not something a stranger
		114	// should be able to do by typing a name.
		115	add("open_registration_role must be none, read or contribute, got %q: self-registration cannot grant review or branch rights", role)
	112	116	}
	113	117	}
	114	118
@@ -124,6 +128,9 @@ func (c *Config) Validate() error {
	124	128	{"lfs_object_max_bytes", c.LFSObjectMaxBytes},
	125	129	{"lfs_warn_bytes", c.LFSWarnBytes},
	126	130	{"pages_cache_bytes", c.PagesCacheBytes},
		131	{"repo_max_metadata_bytes", c.RepoMaxMetadataBytes},
		132	{"repo_max_bytes", c.RepoMaxBytes},
		133	{"repo_max_lfs_bytes", c.RepoMaxLFSBytes},
	127	134	} {
	128	135	if s.v < 0 {
	129	136	add("%s must not be negative, got %d", s.name, s.v)
@@ -139,6 +146,15 @@ func (c *Config) Validate() error {
	139	146	if c.MaxJobsPerRepo < 0 {
	140	147	add("max_jobs_per_repo must not be negative, got %d", c.MaxJobsPerRepo)
	141	148	}
		149	if c.RepoMaxRefs < 0 {
		150	add("repo_max_refs must not be negative, got %d", c.RepoMaxRefs)
		151	}
		152	if c.RepoMaxMetadataEntries < 0 {
		153	add("repo_max_metadata_entries must not be negative, got %d", c.RepoMaxMetadataEntries)
		154	}
		155	if c.AccountWritesPerHour < 0 {
		156	add("account_writes_per_hour must not be negative, got %d", c.AccountWritesPerHour)
		157	}
	142	158	if c.PagesProcs < 0 \|\| c.PagesProcs > 64 {
	143	159	add("pages_procs must be between 0 and 64, got %d", c.PagesProcs)
	144	160	}