vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Document the root-level URL layout
b7396a1155147a13c5595216f204a545e9f74202 · Keenan Nemetz · 10h ago · parent ed03b3d1
Document the root-level URL layout The guides now say /<name> for a repository and /-/ for the forge's own pages, including the clone examples, theme asset paths, profile and registration URLs, robots.txt, and the deployment package URLs. docs/architecture.md gains a short URL layout section: why the two spaces cannot collide, the four root names the forge keeps, and why the transport carries .git. docs/go-modules.md follows the layout: the module path is the repository page, the clone URL is the same name with .git, discovery is answered before the router, and a published module path is durable because renaming the repository breaks it.
docs/accounts-and-access.md +7−7
| @@ -78,8 +78,8 @@ anyone else's. | |||
| 78 | 78 | ||
| 79 | 79 | ## Profiles and the user directory | |
| 80 | 80 | ||
| 81 | Account names are public on an instance. `/u` lists everyone who has an account, | ||
| 82 | and `/u/<name>` is that person's profile: what they have opened, reviewed and | ||
| 81 | Account names are public on an instance. `/-/u` lists everyone who has an account, | ||
| 82 | and `/-/u/<name>` is that person's profile: what they have opened, reviewed and | ||
| 83 | 83 | commented on, and the repositories that work is in. Retiring an account keeps its | |
| 84 | 84 | page, marked as no longer active, because every closed issue and merged change | |
| 85 | 85 | still refers to the name. | |
| @@ -145,7 +145,7 @@ WebAuthn ceremony without a canonical secure origin. | |||
| 145 | 145 | ||
| 146 | 146 | 1. An instance admin creates the account and gives the person its one-time | |
| 147 | 147 | enrollment link, or the server has `open_registration = true` and the person | |
| 148 | creates the account at `/register`. | ||
| 148 | creates the account at `/-/register`. | ||
| 149 | 149 | 2. The person registers a passkey. | |
| 150 | 150 | 3. The passkey creates a browser session. The session cookie is HttpOnly and | |
| 151 | 151 | Secure; Vole stores only its hash. | |
| @@ -165,9 +165,9 @@ one. If the person loses every passkey, an instance admin issues a new link; the | |||
| 165 | 165 | is no password reset to phish. Retiring an account deletes its sessions | |
| 166 | 166 | immediately, and removing a passkey deletes the sessions that passkey created. | |
| 167 | 167 | ||
| 168 | The link carries its token in the URL fragment — `https://forge.example.com/invite#<token>` | ||
| 168 | The link carries its token in the URL fragment — `https://forge.example.com/-/invite#<token>` | ||
| 169 | 169 | — so the browser never sends it to the server, a proxy's access log, or the | |
| 170 | referrer of anything the page loads. Links issued in the older `/invite/<token>` | ||
| 170 | referrer of anything the page loads. Links issued in the older `/-/invite/<token>` | ||
| 171 | 171 | shape still work: Vole redirects them into the fragment, and its own logs redact | |
| 172 | 172 | the old path. | |
| 173 | 173 | ||
| @@ -191,7 +191,7 @@ until an admin removes the passkey; that is the deliberate trade. Synced | |||
| 191 | 191 | passkeys that always report zero are handled by WebAuthn's own rule and do not | |
| 192 | 192 | trigger the refusal. | |
| 193 | 193 | ||
| 194 | With `open_registration = true`, `/register` creates a new account and its first | ||
| 194 | With `open_registration = true`, `/-/register` creates a new account and its first | ||
| 195 | 195 | passkey without an instance admin. Set `open_registration_role` to the | |
| 196 | 196 | instance-wide role those accounts should have; `contribute` is the usual choice | |
| 197 | 197 | for an open-source instance: | |
| @@ -258,7 +258,7 @@ Instance admins also get an **Admin** page in the top navigation. Its tabs cover | |||
| 258 | 258 | the instance's overview, storage, runners, and effective configuration; an | |
| 259 | 259 | Accounts tab that creates a person from an enrollment link or an automation | |
| 260 | 260 | account; and the audit log. Existing accounts are managed from the users | |
| 261 | directory at `/u`, which is searchable and paginated: an instance admin gets a | ||
| 261 | directory at `/-/u`, which is searchable and paginated: an instance admin gets a | ||
| 262 | 262 | **Manage** action on each row that opens the account page, where they set its | |
| 263 | 263 | instance-wide role (including `admin`), retire it, start a fresh enrollment link, | |
| 264 | 264 | and inspect or revoke SSH keys and browser sessions. Repository creation is a | |