2 .\" Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 .Nd gotd configuration file
24 is the run-time configuration file for
27 The file format is line-based, with one configuration directive per line.
28 Any lines beginning with a
30 are treated as comments and ignored.
31 .Sh GLOBAL CONFIGURATION
32 The available global configuration directives are as follows:
34 .It Ic connection Ar option
35 Set the specified options and limits for connections to the
41 directive may be specified multiple times, and multiple
43 arguments may be specified within curly braces:
45 .Ic connection Brq Ar ...
47 Each option should only be specified once.
48 If a given option is listed multiple times, the last line which sets this
51 Valid connection options are:
53 .It Ic request timeout Ar seconds
54 Specify the inactivity timeout for operations between client and server.
55 If this timeout is exceeded while a Git protocol request is being processed,
56 the request will be aborted and the connection will be terminated.
58 The default timeout is 3600 seconds (1 hour).
59 This should only be changed if legitimate requests are exceeding the default
60 timeout for some reason, such as the server spending an extraordinary
61 amount of time generating a pack file.
62 .It Ic limit Ic user Ar identity Ar number
63 Limit the maximum amount of concurrent connections by the user with
68 Numeric user IDs are also accepted.
70 The default per-user limit is 4.
71 This should only be changed if concurrent connections from a given user are
72 expected to exceed the default limit, for example if an anonymous user
73 is granted read access and many concurrent connections will share this
74 anonymous user identity.
76 .It Ic unix_socket Ar path
77 Set the path to the unix socket which
80 If not specified, the path
81 .Pa /var/run/gotd.sock
83 .It Ic unix_group Ar group
88 file, which is allowed to access
94 user must be a secondary member of this group.
95 If not specified, the group _gotsh will be used.
103 requires root privileges in order to create its unix socket.
106 drops privileges to the specified
108 If not specified, the user _gotd will be used.
110 .Sh REPOSITORY CONFIGURATION
111 At least one repository context must exist for
114 For each repository, access rules must be configured using the
118 configuration directives.
119 Multiple access rules can be specified, and the last matching rule
120 determines the action taken.
121 If no rule matches, access to the repository is denied.
123 A repository context is declared with a unique
125 followed by repository-specific configuration directives inside curly braces:
127 .Ic repository Ar name Brq ...
132 clients can connect to a repository by including the repository's unique
135 Clients appending the string
139 will also be accepted.
143 may contain path-separators,
145 to expose repositories as part of a virtual client-visible directory hierarchy.
147 The available repository configuration directives are as follows:
149 .It Ic deny Ar identity
150 Deny repository access to users with the username
152 Group names may be matched by prepending a colon
156 Numeric IDs are also accepted.
158 Set the path to the Git repository.
160 .It Ic permit Ar mode Ar identity
161 Permit repository access to users with the username
165 argument must be set to either
167 for read-only access,
170 for read-write access.
171 Group names may be matched by prepending a colon
175 Numeric IDs are also accepted.
178 .Bl -tag -width Ds -compact
179 .It Pa /etc/gotd.conf
185 .Bd -literal -offset indent
186 # Default unix_group and user values:
190 # This repository can be accessed via ssh://user@example.com/src
192 path "/var/git/src.git"
193 permit rw flan_hacker
194 permit rw :developers
198 # This repository can be accessed via
199 # ssh://user@example.com/openbsd/ports
200 repository "openbsd/ports" {
201 path "/var/git/ports.git"
207 # Use a larger request timeout value:
208 connection request timeout 7200 # 2 hours
210 # Some users are granted a higher concurrent connection limit:
212 limit user flan_hacker 16
213 limit user anonymous 32
