vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Bound what one repository and one account can cost

9e8cc1553e7b4479e0d9a3d7afd044a0755423ba · Keenan Nemetz · 13d ago · parent 701232cf

Bound what one repository and one account can cost

A repository had no quotas. A contributor could add branches in their own
namespace without limit, any writer could add issues and comments, a
maintainer could add tags, and every page that listed or parsed them grew
with the count. The instance's only answer was an admin deleting things
by hand.

Repository quotas now run in pre-receive, so a refused push moves no
refs, and they describe the repository the push would leave rather than
the one it found:

  repo_max_refs              branches and tags, counted with the refs the
                             push creates and deletes
  repo_max_metadata_entries  documents on the metadata branch: issues,
                             requests, comments, approvals, runs, releases
  repo_max_metadata_bytes    their total size
  repo_max_bytes             git objects on disk; a repository already
                             over it refuses further pushes, so growth is
                             the cap plus one permitted push
  repo_max_lfs_bytes         LFS objects, logs and artifacts, enforced on
                             the upload where the bytes arrive, with 413

The values reach the hook the same way the blob limit does: from the
instance config through the SSH server's environment, so a quota is one
setting rather than a second policy.

Browser writes are budgeted per account (`account_writes_per_hour`, 300).
The limiter is keyed by the account rather than the address, because the
account is what a write is attributed to; a person discussing never
reaches it.

Reads that a repository's own writers control are capped: for-each-ref
listings (branches, tags) return at most 500, while the quota check uses
a count that sees all of them. Activity feeds and state changes were
already bounded.

Open registration's baseline is unchanged (off, role none) and its role
is now restricted to none, read or contribute: a stranger who typed a
name must not be able to move a shared branch or approve a review.

Tests: refs (a new ref is counted, moving one is not), metadata entries
and bytes (a tree with two issues refuses at one, and passes at a
generous limit), repository size, and the LFS quota against a real store;
the transfer refuses a 413 upload over the object cap; the account write
budget; and the registration role refusal.

server/web/ratelimit.go +33−1

@@ -41,6 +41,10 @@ const (
	41	41	registrationsPerAddress = 5
	42	42	// authLimitWindow is the window every budget above is counted in.
	43	43	authLimitWindow = time.Minute
		44	// defaultWritesPerHour bounds one account's browser writes (issues, comments,
		45	// requests, labels, state changes). A person discussing never comes near it; a
		46	// script posting in a loop does.
		47	defaultWritesPerHour = 300
	44	48	// maxLimitKeys bounds the table. Keys are addresses and account names; the
	45	49	// sweep drops the ones whose window has passed, and a table past this size is
	46	50	// cleared rather than grown, because the alternative is memory an anonymous
@@ -110,15 +114,43 @@ type authLimits struct {
	110	114	beginAccount *rateLimiter
	111	115	finish *rateLimiter
	112	116	register *rateLimiter
		117	// write bounds one account's repository writes for an hour. It is keyed by the
		118	// account rather than the address, because the account is what a write is
		119	// attributed to and because one person may use two browsers.
		120	write *rateLimiter
	113	121	}
	114	122
	115		func newAuthLimits() authLimits {
		123	func newAuthLimits(writesPerHour int) authLimits {
		124	if writesPerHour <= 0 {
		125	writesPerHour = defaultWritesPerHour
		126	}
	116	127	return authLimits{
	117	128	beginAddress: newRateLimiter(authBeginsPerAddress, authLimitWindow),
	118	129	beginAccount: newRateLimiter(authBeginsPerAccount, authLimitWindow),
	119	130	finish: newRateLimiter(authFinishesPerAddress, authLimitWindow),
	120	131	register: newRateLimiter(registrationsPerAddress, authLimitWindow),
		132	write: newRateLimiter(writesPerHour, time.Hour),
		133	}
		134	}
		135
		136	// limitForm is limit for a form post: the refusal is a plain-text answer a browser
		137	// form can display, not a JSON error.
		138	func (w Web) limitForm(rw http.ResponseWriter, r http.Request, l *rateLimiter, key string) bool {
		139	ok, wait := l.allow(key)
		140	if ok {
		141	return true
	121	142	}
		143	seconds := int(wait.Seconds() + 0.5)
		144	if seconds < 1 {
		145	seconds = 1
		146	}
		147	rw.Header().Set("Retry-After", strconv.Itoa(seconds))
		148	if w.Logger != nil {
		149	w.Logger("write limit: %s %s by %s", r.Method, loggablePath(r.URL.Path), key)
		150	}
		151	http.Error(rw, fmt.Sprintf("you are writing too quickly; try again in %d second(s)", seconds),
		152	http.StatusTooManyRequests)
		153	return false
	122	154	}
	123	155
	124	156	// clientAddress is the key the address budgets count under. Behind a trusted proxy