Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Unify terminology across the web UI and docs

ab326d3ac1fd947a9df45f31f6dc10ab38627882 · Keenan Nemetz · 14d ago · parent 5b814e99 

Unify terminology across the web UI and docs

Use account, repository, change request, enrollment link, instance admin, and sign in/out consistently. Rename the access guide to accounts-and-access.md, update its links, and record the canonical terms and retained command/URL spellings in the documentation index.

docs/users-and-access.md → docs/accounts-and-access.md +12−12

@@ -1,4 +1,4 @@
1 # Users and access
1 # Accounts and access
2 2
3 3 Vole has no password database. An account has two kinds of credential:
4 4
@@ -23,8 +23,8 @@ point at a different person.
23 23
24 24 Account data lives in `data/users.db`. It also holds passkeys, one-time
25 25 enrollment links, browser sessions, repository access rules, and file locks.
26 Credentials are public keys and session or invite tokens are stored only as
27 hashes. Vole reloads the roster every few seconds, so key changes and retirements
26 Credentials are public keys, and session or enrollment-link tokens are stored
27 only as hashes. Vole reloads the roster every few seconds, so key changes and retirements
28 28 take effect without restarting the server.
29 29
30 30 ```sh
@@ -46,11 +46,11 @@ command to change the account name.
46 46
47 47 ## Browser sign-in
48 48
49 Browser login uses a passkey (Touch ID, Windows Hello, a phone, or a security
49 Browser sign-in uses a passkey (Touch ID, Windows Hello, a phone, or a security
50 50 key). It requires `public_url` to be an `https://` URL; Vole refuses to start a
51 51 WebAuthn ceremony without a canonical secure origin.
52 52
53 1. An administrator creates the account and gives the person its one-time
53 1. An instance admin creates the account and gives the person its one-time
54 54 enrollment link, or the server has `open_registration = true` and the person
55 55 creates the account at `/register`.
56 56 2. The person registers a passkey.
@@ -60,12 +60,12 @@ WebAuthn ceremony without a canonical secure origin.
60 60 keys, or review their sessions.
61 61
62 62 A link is single-use and expires. Issuing a new link invalidates the previous
63 one. If the person loses every passkey, an administrator issues a new link; there
63 one. If the person loses every passkey, an instance admin issues a new link; there
64 64 is no password reset to phish. Retiring an account deletes its sessions
65 65 immediately, and removing a passkey deletes the sessions that passkey created.
66 66
67 67 With `open_registration = true`, `/register` creates a new account and its first
68 passkey without an administrator. Set `open_registration_role` to the
68 passkey without an instance admin. Set `open_registration_role` to the
69 69 instance-wide role those accounts should have; `contribute` is the usual choice
70 70 for an open-source instance:
71 71
@@ -111,14 +111,14 @@ vole admin --remote origin repo create demo --owner bob
111 111 vole admin --remote origin acl default demo read
112 112 ```
113 113
114 An instance admin is the instance-wide `admin` role. They can create users and
114 An instance admin is the instance-wide `admin` role. They can create accounts and
115 115 repositories, change access rules anywhere, and use `--remote`. They are also a
116 116 repository admin on every repository, private ones included: they can push,
117 117 change settings, and manage access without a repository-specific entry. SSH Git
118 118 and SSH LFS use the key's account for this check; anonymous HTTP clone has no
119 119 identity, so a private repository still answers `404` there.
120 120
121 Instance admins also get a **Users** page in the top navigation. It covers
121 Instance admins also get an **Accounts** page in the top navigation. It covers
122 122 accounts: create an account from an enrollment link, set its instance-wide role
123 123 (including `admin`), retire an account, start a fresh enrollment link, and
124 124 inspect or revoke SSH keys and browser sessions. Repository creation is a **New repository** action
@@ -221,7 +221,7 @@ vole admin acl runners demo ci-runner-1
221 221
222 222 ## Contributors and their branches
223 223
224 The `contribute` role is for open-source projects that accept outside patches.
224 The `contribute` role is for open-source repositories that accept outside patches.
225 225 A contributor can read, file issues and comments, and open a change request from
226 226 the browser. Their Git writes are confined to a branch folder named after their
227 227 account name:
@@ -253,7 +253,7 @@ Contributor branches are ordinary branches except for one rule: CI does not run
253 253 for them automatically. A maintainer or admin opens the change request for the
254 254 branch and chooses **Allow CI** there. The approval names the exact
255 255 commit, so every new push waits again. Treat runner isolation as part of the trust decision before granting
256 `contribute` on a public project.
256 `contribute` on a public repository.
257 257
258 258 ## When rules are checked
259 259
@@ -263,7 +263,7 @@ capability and use the same metadata writers and validation as the CLI.
263 263
264 264 That includes protected branches, approvals, required checks, file size limits,
265 265 locks, issue formatting, and the CI runner allowlist. Privileged actions — such as
266 an admin force-push, a lock override, a user change, or a merge through review —
266 an admin force-push, a lock override, an account change, or a merge through review —
267 267 are written to `data/audit.log`.
268 268
269 269 For the reasoning behind this design, see