vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Budget only the untrusted write role

e5542ac6b64fa3ebaf62af4831e55996dba45e7e · Keenan Nemetz · 13d ago · parent 9e8cc155

Budget only the untrusted write role

Maintainers and admins are trusted roles: they can already change the
rules, push shared branches and run the instance, so a write budget would
slow their work without bounding anybody who could not do worse. The
budget now applies only below maintain, which is the contribute role and
the read-only accounts that cannot write at all.

The setting is named for what it does: contributor_writes_per_hour. The
role is the effective one on the repository, so an instance-wide
maintainer on a public repository is exempt for the same reason a
repository maintainer is.

forge/config/config.go +7−4

@@ -88,10 +88,13 @@ type Config struct {
	88	88	// RepoMaxLFSBytes bounds one repository's LFS objects, CI logs and run
	89	89	// artifacts. It is enforced where the bytes arrive, on the upload.
	90	90	RepoMaxLFSBytes int64 `toml:"repo_max_lfs_bytes"`
	91		// AccountWritesPerHour bounds how many repository writes one account may make
	92		// from the browser: issues, comments, requests, labels, state changes. A person
	93		// writing discussion never comes near it; a script posting in a loop does.
	94		AccountWritesPerHour int `toml:"account_writes_per_hour"`
		91	// ContributorWritesPerHour bounds how many repository writes an untrusted
		92	// account may make from the browser in an hour: issues, comments, requests,
		93	// labels, state changes. It is deliberately not a per-account budget for
		94	// everybody — maintainers and admins are trusted roles that can already change
		95	// these rules, push shared branches and run the instance, so budgeting them
		96	// would slow their work without bounding anybody who could not do worse.
		97	ContributorWritesPerHour int `toml:"contributor_writes_per_hour"`
	95	98	// LFSObjectMaxBytes caps a single LFS object.
	96	99	LFSObjectMaxBytes int64 `toml:"lfs_object_max_bytes"`
	97	100	// LFSWarnBytes makes a push that commits a binary larger than this carry a