Krolyxon
Commit e758199

Branches

Tags

Refs →

ferreniume758199

Hardening, release tooling and GPL-3.0 license (M5)

- Load shedding (limits.max_requests), bounded heavy-permit waits
  (limits.heavy_wait_secs), live request timeout that only covers the
  start of a response, and git permits held by the blocking job
- Styled error pages for panics, timeouts, overload and 405s; 5xx no-store;
  Cross-Origin-Opener-Policy
- Clone requests capped at 64 MiB
- gzip only (brotli's per-response memory wasn't worth ~2%); git_parallel
  defaults to CPUs, at most 8; fat LTO
- Tighter systemd sandbox (systemd-analyze security: 1.2)
- Release workflow: x86_64 and aarch64 binaries against glibc 2.28,
  published with install.sh and SHA256SUMS; CI workflow
- install.sh: curl | sudo sh installer for the binary, git user, config
  and systemd unit
- Generic example config and Caddyfile; concise README
Author
krolyxon
Date
2026-11-05 22:44 +0530
Parent
18ca21c
Commit
e75819959230dfab630d984819fa388b8fb2e4f8

+1287 −90

19 files changed

Browse files Patch
−Context 3+
  1. A .github/workflows/ci.yml +16 −0
  2. A .github/workflows/release.yml +63 −0
  3. M Cargo.lock +0 −37
  4. M Cargo.toml +4 −2
  5. A LICENSE +674 −0
  6. A README.md +141 −0
  7. M dist/Caddyfile +1 −1
  8. M dist/ferrenium.service +13 −1
  9. M dist/ferrenium.toml +13 −10
  10. A dist/install.sh +146 −0
  11. M src/config.rs +13 −3
  12. M src/handlers/error.rs +22 −2
  13. M src/server/clone.rs +21 −4
  14. M src/server/dispatch.rs +4 −4
  15. M src/server/headers.rs +5 −1
  16. M src/server/mod.rs +42 −10
  17. M src/state.rs +31 −13
  18. M tests/extras.rs +77 −1
  19. M tests/http.rs +1 −1
A .github/workflows/ci.yml View
@@ -0,0 +1,16 @@
1+name: ci
2+
3+on:
4+ push:
5+ branches: [master]
6+ pull_request:
7+
8+jobs:
9+ test:
10+ runs-on: ubuntu-latest
11+ steps:
12+ - uses: actions/checkout@v4
13+ - run: cargo fmt --check
14+ - run: cargo clippy --all-targets --locked -- -D warnings
15+ - run: cargo test --locked
16+ - run: cargo test --release --locked
A .github/workflows/release.yml View
@@ -0,0 +1,63 @@
1+name: release
2+
3+on:
4+ push:
5+ tags: ["v*"]
6+
7+permissions:
8+ contents: write
9+
10+jobs:
11+ test:
12+ runs-on: ubuntu-latest
13+ steps:
14+ - uses: actions/checkout@v4
15+ - name: Tag matches Cargo.toml
16+ run: |
17+ version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
18+ if [ "v$version" != "$GITHUB_REF_NAME" ]; then
19+ echo "tag $GITHUB_REF_NAME does not match Cargo.toml version $version"
20+ exit 1
21+ fi
22+ - run: cargo fmt --check
23+ - run: cargo clippy --all-targets --locked -- -D warnings
24+ - run: cargo test --release --locked
25+
26+ build:
27+ needs: test
28+ runs-on: ubuntu-latest
29+ strategy:
30+ matrix:
31+ arch: [x86_64, aarch64]
32+ steps:
33+ - uses: actions/checkout@v4
34+ - name: Install cargo-zigbuild
35+ run: |
36+ python3 -m venv "$RUNNER_TEMP/zig"
37+ "$RUNNER_TEMP/zig/bin/pip" install --quiet cargo-zigbuild
38+ echo "$RUNNER_TEMP/zig/bin" >> "$GITHUB_PATH"
39+ rustup target add ${{ matrix.arch }}-unknown-linux-gnu
40+ # Linked against glibc 2.28, so it runs on Debian 10+, Ubuntu 20.04+, RHEL 8+.
41+ - run: cargo zigbuild --release --locked --target ${{ matrix.arch }}-unknown-linux-gnu.2.28
42+ - run: tar -czf ferrenium-${{ matrix.arch }}-linux.tar.gz -C target/${{ matrix.arch }}-unknown-linux-gnu/release ferrenium
43+ - uses: actions/upload-artifact@v4
44+ with:
45+ name: ferrenium-${{ matrix.arch }}
46+ path: ferrenium-${{ matrix.arch }}-linux.tar.gz
47+
48+ release:
49+ needs: build
50+ runs-on: ubuntu-latest
51+ steps:
52+ - uses: actions/checkout@v4
53+ - uses: actions/download-artifact@v4
54+ with:
55+ merge-multiple: true
56+ - name: Publish
57+ env:
58+ GH_TOKEN: ${{ github.token }}
59+ run: |
60+ cp dist/install.sh .
61+ sha256sum ferrenium-*-linux.tar.gz install.sh > SHA256SUMS
62+ gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes \
63+ ferrenium-*-linux.tar.gz install.sh SHA256SUMS
M Cargo.lock View
@@ -17,21 +17,6 @@ dependencies = [
1717 "memchr",
1818 ]
1919
20−[[package]]
21−name = "alloc-no-stdlib"
22−version = "3.0.0"
23−source = "registry+https://github.com/rust-lang/crates.io-index"
24−checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a"
25−
26−[[package]]
27−name = "alloc-stdlib"
28−version = "0.3.0"
29−source = "registry+https://github.com/rust-lang/crates.io-index"
30−checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1"
31−dependencies = [
32− "alloc-no-stdlib",
33−]
34−
3520 [[package]]
3621 name = "allocator-api2"
3722 version = "0.2.21"
@@ -301,27 +286,6 @@ dependencies = [
301286 "hybrid-array",
302287 ]
303288
304−[[package]]
305−name = "brotli"
306−version = "9.1.1"
307−source = "registry+https://github.com/rust-lang/crates.io-index"
308−checksum = "627b7cfb0578f0eafce087a90fcd40add1231900b69e4d4de2d456260a4f5d81"
309−dependencies = [
310− "alloc-no-stdlib",
311− "alloc-stdlib",
312− "brotli-decompressor",
313−]
314−
315−[[package]]
316−name = "brotli-decompressor"
317−version = "6.2.0"
318−source = "registry+https://github.com/rust-lang/crates.io-index"
319−checksum = "34c6783f42c21c952ad7112b354f0ba2f10760e9decea5b1b60523d6e270faaf"
320−dependencies = [
321− "alloc-no-stdlib",
322− "alloc-stdlib",
323−]
324−
325289 [[package]]
326290 name = "bstr"
327291 version = "1.13.1"
@@ -427,7 +391,6 @@ version = "0.4.47"
427391 source = "registry+https://github.com/rust-lang/crates.io-index"
428392 checksum = "84f840cff84d10085260e460023934d0af699e71212b09b2a41452e8bd9cda43"
429393 dependencies = [
430− "brotli",
431394 "compression-core",
432395 "flate2",
433396 "memchr",
M Cargo.toml View
@@ -4,6 +4,8 @@ version = "0.1.0"
44 edition = "2024"
55 rust-version = "1.89"
66 description = "A fast, read-only Git repository browser"
7+license = "GPL-3.0-only"
8+repository = "https://github.com/krolyxon/ferrenium"
79 publish = false
810
911 [dependencies]
@@ -34,7 +36,7 @@ tokio = { version = "1.54.1", features = ["rt-multi-thread", "macros", "net", "s
3436 tokio-util = { version = "0.7", features = ["io", "io-util"] }
3537 toml = "1.2.0"
3638 tower = { version = "0.5.3", features = ["util"] }
37−tower-http = { version = "0.7.1", features = ["trace", "timeout", "catch-panic", "compression-gzip", "compression-br", "set-header"] }
39+tower-http = { version = "0.7.1", features = ["trace", "catch-panic", "compression-gzip", "set-header"] }
3840 tracing = "0.1.44"
3941 tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt"] }
4042 two-face = { version = "0.5", default-features = false, features = ["syntect-fancy"] }
@@ -43,6 +45,6 @@ two-face = { version = "0.5", default-features = false, features = ["syntect-fan
4345 tempfile = "3"
4446
4547 [profile.release]
46−lto = "thin"
48+lto = "fat"
4749 codegen-units = 1
4850 strip = true
A LICENSE View
@@ -0,0 +1,674 @@
1+ GNU GENERAL PUBLIC LICENSE
2+ Version 3, 29 June 2007
3+
4+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
5+ Everyone is permitted to copy and distribute verbatim copies
6+ of this license document, but changing it is not allowed.
7+
8+ Preamble
9+
10+ The GNU General Public License is a free, copyleft license for
11+software and other kinds of works.
12+
13+ The licenses for most software and other practical works are designed
14+to take away your freedom to share and change the works. By contrast,
15+the GNU General Public License is intended to guarantee your freedom to
16+share and change all versions of a program--to make sure it remains free
17+software for all its users. We, the Free Software Foundation, use the
18+GNU General Public License for most of our software; it applies also to
19+any other work released this way by its authors. You can apply it to
20+your programs, too.
21+
22+ When we speak of free software, we are referring to freedom, not
23+price. Our General Public Licenses are designed to make sure that you
24+have the freedom to distribute copies of free software (and charge for
25+them if you wish), that you receive source code or can get it if you
26+want it, that you can change the software or use pieces of it in new
27+free programs, and that you know you can do these things.
28+
29+ To protect your rights, we need to prevent others from denying you
30+these rights or asking you to surrender the rights. Therefore, you have
31+certain responsibilities if you distribute copies of the software, or if
32+you modify it: responsibilities to respect the freedom of others.
33+
34+ For example, if you distribute copies of such a program, whether
35+gratis or for a fee, you must pass on to the recipients the same
36+freedoms that you received. You must make sure that they, too, receive
37+or can get the source code. And you must show them these terms so they
38+know their rights.
39+
40+ Developers that use the GNU GPL protect your rights with two steps:
41+(1) assert copyright on the software, and (2) offer you this License
42+giving you legal permission to copy, distribute and/or modify it.
43+
44+ For the developers' and authors' protection, the GPL clearly explains
45+that there is no warranty for this free software. For both users' and
46+authors' sake, the GPL requires that modified versions be marked as
47+changed, so that their problems will not be attributed erroneously to
48+authors of previous versions.
49+
50+ Some devices are designed to deny users access to install or run
51+modified versions of the software inside them, although the manufacturer
52+can do so. This is fundamentally incompatible with the aim of
53+protecting users' freedom to change the software. The systematic
54+pattern of such abuse occurs in the area of products for individuals to
55+use, which is precisely where it is most unacceptable. Therefore, we
56+have designed this version of the GPL to prohibit the practice for those
57+products. If such problems arise substantially in other domains, we
58+stand ready to extend this provision to those domains in future versions
59+of the GPL, as needed to protect the freedom of users.
60+
61+ Finally, every program is threatened constantly by software patents.
62+States should not allow patents to restrict development and use of
63+software on general-purpose computers, but in those that do, we wish to
64+avoid the special danger that patents applied to a free program could
65+make it effectively proprietary. To prevent this, the GPL assures that
66+patents cannot be used to render the program non-free.
67+
68+ The precise terms and conditions for copying, distribution and
69+modification follow.
70+
71+ TERMS AND CONDITIONS
72+
73+ 0. Definitions.
74+
75+ "This License" refers to version 3 of the GNU General Public License.
76+
77+ "Copyright" also means copyright-like laws that apply to other kinds of
78+works, such as semiconductor masks.
79+
80+ "The Program" refers to any copyrightable work licensed under this
81+License. Each licensee is addressed as "you". "Licensees" and
82+"recipients" may be individuals or organizations.
83+
84+ To "modify" a work means to copy from or adapt all or part of the work
85+in a fashion requiring copyright permission, other than the making of an
86+exact copy. The resulting work is called a "modified version" of the
87+earlier work or a work "based on" the earlier work.
88+
89+ A "covered work" means either the unmodified Program or a work based
90+on the Program.
91+
92+ To "propagate" a work means to do anything with it that, without
93+permission, would make you directly or secondarily liable for
94+infringement under applicable copyright law, except executing it on a
95+computer or modifying a private copy. Propagation includes copying,
96+distribution (with or without modification), making available to the
97+public, and in some countries other activities as well.
98+
99+ To "convey" a work means any kind of propagation that enables other
100+parties to make or receive copies. Mere interaction with a user through
101+a computer network, with no transfer of a copy, is not conveying.
102+
103+ An interactive user interface displays "Appropriate Legal Notices"
104+to the extent that it includes a convenient and prominently visible
105+feature that (1) displays an appropriate copyright notice, and (2)
106+tells the user that there is no warranty for the work (except to the
107+extent that warranties are provided), that licensees may convey the
108+work under this License, and how to view a copy of this License. If
109+the interface presents a list of user commands or options, such as a
110+menu, a prominent item in the list meets this criterion.
111+
112+ 1. Source Code.
113+
114+ The "source code" for a work means the preferred form of the work
115+for making modifications to it. "Object code" means any non-source
116+form of a work.
117+
118+ A "Standard Interface" means an interface that either is an official
119+standard defined by a recognized standards body, or, in the case of
120+interfaces specified for a particular programming language, one that
121+is widely used among developers working in that language.
122+
123+ The "System Libraries" of an executable work include anything, other
124+than the work as a whole, that (a) is included in the normal form of
125+packaging a Major Component, but which is not part of that Major
126+Component, and (b) serves only to enable use of the work with that
127+Major Component, or to implement a Standard Interface for which an
128+implementation is available to the public in source code form. A
129+"Major Component", in this context, means a major essential component
130+(kernel, window system, and so on) of the specific operating system
131+(if any) on which the executable work runs, or a compiler used to
132+produce the work, or an object code interpreter used to run it.
133+
134+ The "Corresponding Source" for a work in object code form means all
135+the source code needed to generate, install, and (for an executable
136+work) run the object code and to modify the work, including scripts to
137+control those activities. However, it does not include the work's
138+System Libraries, or general-purpose tools or generally available free
139+programs which are used unmodified in performing those activities but
140+which are not part of the work. For example, Corresponding Source
141+includes interface definition files associated with source files for
142+the work, and the source code for shared libraries and dynamically
143+linked subprograms that the work is specifically designed to require,
144+such as by intimate data communication or control flow between those
145+subprograms and other parts of the work.
146+
147+ The Corresponding Source need not include anything that users
148+can regenerate automatically from other parts of the Corresponding
149+Source.
150+
151+ The Corresponding Source for a work in source code form is that
152+same work.
153+
154+ 2. Basic Permissions.
155+
156+ All rights granted under this License are granted for the term of
157+copyright on the Program, and are irrevocable provided the stated
158+conditions are met. This License explicitly affirms your unlimited
159+permission to run the unmodified Program. The output from running a
160+covered work is covered by this License only if the output, given its
161+content, constitutes a covered work. This License acknowledges your
162+rights of fair use or other equivalent, as provided by copyright law.
163+
164+ You may make, run and propagate covered works that you do not
165+convey, without conditions so long as your license otherwise remains
166+in force. You may convey covered works to others for the sole purpose
167+of having them make modifications exclusively for you, or provide you
168+with facilities for running those works, provided that you comply with
169+the terms of this License in conveying all material for which you do
170+not control copyright. Those thus making or running the covered works
171+for you must do so exclusively on your behalf, under your direction
172+and control, on terms that prohibit them from making any copies of
173+your copyrighted material outside their relationship with you.
174+
175+ Conveying under any other circumstances is permitted solely under
176+the conditions stated below. Sublicensing is not allowed; section 10
177+makes it unnecessary.
178+
179+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180+
181+ No covered work shall be deemed part of an effective technological
182+measure under any applicable law fulfilling obligations under article
183+11 of the WIPO copyright treaty adopted on 20 December 1996, or
184+similar laws prohibiting or restricting circumvention of such
185+measures.
186+
187+ When you convey a covered work, you waive any legal power to forbid
188+circumvention of technological measures to the extent such circumvention
189+is effected by exercising rights under this License with respect to
190+the covered work, and you disclaim any intention to limit operation or
191+modification of the work as a means of enforcing, against the work's
192+users, your or third parties' legal rights to forbid circumvention of
193+technological measures.
194+
195+ 4. Conveying Verbatim Copies.
196+
197+ You may convey verbatim copies of the Program's source code as you
198+receive it, in any medium, provided that you conspicuously and
199+appropriately publish on each copy an appropriate copyright notice;
200+keep intact all notices stating that this License and any
201+non-permissive terms added in accord with section 7 apply to the code;
202+keep intact all notices of the absence of any warranty; and give all
203+recipients a copy of this License along with the Program.
204+
205+ You may charge any price or no price for each copy that you convey,
206+and you may offer support or warranty protection for a fee.
207+
208+ 5. Conveying Modified Source Versions.
209+
210+ You may convey a work based on the Program, or the modifications to
211+produce it from the Program, in the form of source code under the
212+terms of section 4, provided that you also meet all of these conditions:
213+
214+ a) The work must carry prominent notices stating that you modified
215+ it, and giving a relevant date.
216+
217+ b) The work must carry prominent notices stating that it is
218+ released under this License and any conditions added under section
219+ 7. This requirement modifies the requirement in section 4 to
220+ "keep intact all notices".
221+
222+ c) You must license the entire work, as a whole, under this
223+ License to anyone who comes into possession of a copy. This
224+ License will therefore apply, along with any applicable section 7
225+ additional terms, to the whole of the work, and all its parts,
226+ regardless of how they are packaged. This License gives no
227+ permission to license the work in any other way, but it does not
228+ invalidate such permission if you have separately received it.
229+
230+ d) If the work has interactive user interfaces, each must display
231+ Appropriate Legal Notices; however, if the Program has interactive
232+ interfaces that do not display Appropriate Legal Notices, your
233+ work need not make them do so.
234+
235+ A compilation of a covered work with other separate and independent
236+works, which are not by their nature extensions of the covered work,
237+and which are not combined with it such as to form a larger program,
238+in or on a volume of a storage or distribution medium, is called an
239+"aggregate" if the compilation and its resulting copyright are not
240+used to limit the access or legal rights of the compilation's users
241+beyond what the individual works permit. Inclusion of a covered work
242+in an aggregate does not cause this License to apply to the other
243+parts of the aggregate.
244+
245+ 6. Conveying Non-Source Forms.
246+
247+ You may convey a covered work in object code form under the terms
248+of sections 4 and 5, provided that you also convey the
249+machine-readable Corresponding Source under the terms of this License,
250+in one of these ways:
251+
252+ a) Convey the object code in, or embodied in, a physical product
253+ (including a physical distribution medium), accompanied by the
254+ Corresponding Source fixed on a durable physical medium
255+ customarily used for software interchange.
256+
257+ b) Convey the object code in, or embodied in, a physical product
258+ (including a physical distribution medium), accompanied by a
259+ written offer, valid for at least three years and valid for as
260+ long as you offer spare parts or customer support for that product
261+ model, to give anyone who possesses the object code either (1) a
262+ copy of the Corresponding Source for all the software in the
263+ product that is covered by this License, on a durable physical
264+ medium customarily used for software interchange, for a price no
265+ more than your reasonable cost of physically performing this
266+ conveying of source, or (2) access to copy the
267+ Corresponding Source from a network server at no charge.
268+
269+ c) Convey individual copies of the object code with a copy of the
270+ written offer to provide the Corresponding Source. This
271+ alternative is allowed only occasionally and noncommercially, and
272+ only if you received the object code with such an offer, in accord
273+ with subsection 6b.
274+
275+ d) Convey the object code by offering access from a designated
276+ place (gratis or for a charge), and offer equivalent access to the
277+ Corresponding Source in the same way through the same place at no
278+ further charge. You need not require recipients to copy the
279+ Corresponding Source along with the object code. If the place to
280+ copy the object code is a network server, the Corresponding Source
281+ may be on a different server (operated by you or a third party)
282+ that supports equivalent copying facilities, provided you maintain
283+ clear directions next to the object code saying where to find the
284+ Corresponding Source. Regardless of what server hosts the
285+ Corresponding Source, you remain obligated to ensure that it is
286+ available for as long as needed to satisfy these requirements.
287+
288+ e) Convey the object code using peer-to-peer transmission, provided
289+ you inform other peers where the object code and Corresponding
290+ Source of the work are being offered to the general public at no
291+ charge under subsection 6d.
292+
293+ A separable portion of the object code, whose source code is excluded
294+from the Corresponding Source as a System Library, need not be
295+included in conveying the object code work.
296+
297+ A "User Product" is either (1) a "consumer product", which means any
298+tangible personal property which is normally used for personal, family,
299+or household purposes, or (2) anything designed or sold for incorporation
300+into a dwelling. In determining whether a product is a consumer product,
301+doubtful cases shall be resolved in favor of coverage. For a particular
302+product received by a particular user, "normally used" refers to a
303+typical or common use of that class of product, regardless of the status
304+of the particular user or of the way in which the particular user
305+actually uses, or expects or is expected to use, the product. A product
306+is a consumer product regardless of whether the product has substantial
307+commercial, industrial or non-consumer uses, unless such uses represent
308+the only significant mode of use of the product.
309+
310+ "Installation Information" for a User Product means any methods,
311+procedures, authorization keys, or other information required to install
312+and execute modified versions of a covered work in that User Product from
313+a modified version of its Corresponding Source. The information must
314+suffice to ensure that the continued functioning of the modified object
315+code is in no case prevented or interfered with solely because
316+modification has been made.
317+
318+ If you convey an object code work under this section in, or with, or
319+specifically for use in, a User Product, and the conveying occurs as
320+part of a transaction in which the right of possession and use of the
321+User Product is transferred to the recipient in perpetuity or for a
322+fixed term (regardless of how the transaction is characterized), the
323+Corresponding Source conveyed under this section must be accompanied
324+by the Installation Information. But this requirement does not apply
325+if neither you nor any third party retains the ability to install
326+modified object code on the User Product (for example, the work has
327+been installed in ROM).
328+
329+ The requirement to provide Installation Information does not include a
330+requirement to continue to provide support service, warranty, or updates
331+for a work that has been modified or installed by the recipient, or for
332+the User Product in which it has been modified or installed. Access to a
333+network may be denied when the modification itself materially and
334+adversely affects the operation of the network or violates the rules and
335+protocols for communication across the network.
336+
337+ Corresponding Source conveyed, and Installation Information provided,
338+in accord with this section must be in a format that is publicly
339+documented (and with an implementation available to the public in
340+source code form), and must require no special password or key for
341+unpacking, reading or copying.
342+
343+ 7. Additional Terms.
344+
345+ "Additional permissions" are terms that supplement the terms of this
346+License by making exceptions from one or more of its conditions.
347+Additional permissions that are applicable to the entire Program shall
348+be treated as though they were included in this License, to the extent
349+that they are valid under applicable law. If additional permissions
350+apply only to part of the Program, that part may be used separately
351+under those permissions, but the entire Program remains governed by
352+this License without regard to the additional permissions.
353+
354+ When you convey a copy of a covered work, you may at your option
355+remove any additional permissions from that copy, or from any part of
356+it. (Additional permissions may be written to require their own
357+removal in certain cases when you modify the work.) You may place
358+additional permissions on material, added by you to a covered work,
359+for which you have or can give appropriate copyright permission.
360+
361+ Notwithstanding any other provision of this License, for material you
362+add to a covered work, you may (if authorized by the copyright holders of
363+that material) supplement the terms of this License with terms:
364+
365+ a) Disclaiming warranty or limiting liability differently from the
366+ terms of sections 15 and 16 of this License; or
367+
368+ b) Requiring preservation of specified reasonable legal notices or
369+ author attributions in that material or in the Appropriate Legal
370+ Notices displayed by works containing it; or
371+
372+ c) Prohibiting misrepresentation of the origin of that material, or
373+ requiring that modified versions of such material be marked in
374+ reasonable ways as different from the original version; or
375+
376+ d) Limiting the use for publicity purposes of names of licensors or
377+ authors of the material; or
378+
379+ e) Declining to grant rights under trademark law for use of some
380+ trade names, trademarks, or service marks; or
381+
382+ f) Requiring indemnification of licensors and authors of that
383+ material by anyone who conveys the material (or modified versions of
384+ it) with contractual assumptions of liability to the recipient, for
385+ any liability that these contractual assumptions directly impose on
386+ those licensors and authors.
387+
388+ All other non-permissive additional terms are considered "further
389+restrictions" within the meaning of section 10. If the Program as you
390+received it, or any part of it, contains a notice stating that it is
391+governed by this License along with a term that is a further
392+restriction, you may remove that term. If a license document contains
393+a further restriction but permits relicensing or conveying under this
394+License, you may add to a covered work material governed by the terms
395+of that license document, provided that the further restriction does
396+not survive such relicensing or conveying.
397+
398+ If you add terms to a covered work in accord with this section, you
399+must place, in the relevant source files, a statement of the
400+additional terms that apply to those files, or a notice indicating
401+where to find the applicable terms.
402+
403+ Additional terms, permissive or non-permissive, may be stated in the
404+form of a separately written license, or stated as exceptions;
405+the above requirements apply either way.
406+
407+ 8. Termination.
408+
409+ You may not propagate or modify a covered work except as expressly
410+provided under this License. Any attempt otherwise to propagate or
411+modify it is void, and will automatically terminate your rights under
412+this License (including any patent licenses granted under the third
413+paragraph of section 11).
414+
415+ However, if you cease all violation of this License, then your
416+license from a particular copyright holder is reinstated (a)
417+provisionally, unless and until the copyright holder explicitly and
418+finally terminates your license, and (b) permanently, if the copyright
419+holder fails to notify you of the violation by some reasonable means
420+prior to 60 days after the cessation.
421+
422+ Moreover, your license from a particular copyright holder is
423+reinstated permanently if the copyright holder notifies you of the
424+violation by some reasonable means, this is the first time you have
425+received notice of violation of this License (for any work) from that
426+copyright holder, and you cure the violation prior to 30 days after
427+your receipt of the notice.
428+
429+ Termination of your rights under this section does not terminate the
430+licenses of parties who have received copies or rights from you under
431+this License. If your rights have been terminated and not permanently
432+reinstated, you do not qualify to receive new licenses for the same
433+material under section 10.
434+
435+ 9. Acceptance Not Required for Having Copies.
436+
437+ You are not required to accept this License in order to receive or
438+run a copy of the Program. Ancillary propagation of a covered work
439+occurring solely as a consequence of using peer-to-peer transmission
440+to receive a copy likewise does not require acceptance. However,
441+nothing other than this License grants you permission to propagate or
442+modify any covered work. These actions infringe copyright if you do
443+not accept this License. Therefore, by modifying or propagating a
444+covered work, you indicate your acceptance of this License to do so.
445+
446+ 10. Automatic Licensing of Downstream Recipients.
447+
448+ Each time you convey a covered work, the recipient automatically
449+receives a license from the original licensors, to run, modify and
450+propagate that work, subject to this License. You are not responsible
451+for enforcing compliance by third parties with this License.
452+
453+ An "entity transaction" is a transaction transferring control of an
454+organization, or substantially all assets of one, or subdividing an
455+organization, or merging organizations. If propagation of a covered
456+work results from an entity transaction, each party to that
457+transaction who receives a copy of the work also receives whatever
458+licenses to the work the party's predecessor in interest had or could
459+give under the previous paragraph, plus a right to possession of the
460+Corresponding Source of the work from the predecessor in interest, if
461+the predecessor has it or can get it with reasonable efforts.
462+
463+ You may not impose any further restrictions on the exercise of the
464+rights granted or affirmed under this License. For example, you may
465+not impose a license fee, royalty, or other charge for exercise of
466+rights granted under this License, and you may not initiate litigation
467+(including a cross-claim or counterclaim in a lawsuit) alleging that
468+any patent claim is infringed by making, using, selling, offering for
469+sale, or importing the Program or any portion of it.
470+
471+ 11. Patents.
472+
473+ A "contributor" is a copyright holder who authorizes use under this
474+License of the Program or a work on which the Program is based. The
475+work thus licensed is called the contributor's "contributor version".
476+
477+ A contributor's "essential patent claims" are all patent claims
478+owned or controlled by the contributor, whether already acquired or
479+hereafter acquired, that would be infringed by some manner, permitted
480+by this License, of making, using, or selling its contributor version,
481+but do not include claims that would be infringed only as a
482+consequence of further modification of the contributor version. For
483+purposes of this definition, "control" includes the right to grant
484+patent sublicenses in a manner consistent with the requirements of
485+this License.
486+
487+ Each contributor grants you a non-exclusive, worldwide, royalty-free
488+patent license under the contributor's essential patent claims, to
489+make, use, sell, offer for sale, import and otherwise run, modify and
490+propagate the contents of its contributor version.
491+
492+ In the following three paragraphs, a "patent license" is any express
493+agreement or commitment, however denominated, not to enforce a patent
494+(such as an express permission to practice a patent or covenant not to
495+sue for patent infringement). To "grant" such a patent license to a
496+party means to make such an agreement or commitment not to enforce a
497+patent against the party.
498+
499+ If you convey a covered work, knowingly relying on a patent license,
500+and the Corresponding Source of the work is not available for anyone
501+to copy, free of charge and under the terms of this License, through a
502+publicly available network server or other readily accessible means,
503+then you must either (1) cause the Corresponding Source to be so
504+available, or (2) arrange to deprive yourself of the benefit of the
505+patent license for this particular work, or (3) arrange, in a manner
506+consistent with the requirements of this License, to extend the patent
507+license to downstream recipients. "Knowingly relying" means you have
508+actual knowledge that, but for the patent license, your conveying the
509+covered work in a country, or your recipient's use of the covered work
510+in a country, would infringe one or more identifiable patents in that
511+country that you have reason to believe are valid.
512+
513+ If, pursuant to or in connection with a single transaction or
514+arrangement, you convey, or propagate by procuring conveyance of, a
515+covered work, and grant a patent license to some of the parties
516+receiving the covered work authorizing them to use, propagate, modify
517+or convey a specific copy of the covered work, then the patent license
518+you grant is automatically extended to all recipients of the covered
519+work and works based on it.
520+
521+ A patent license is "discriminatory" if it does not include within
522+the scope of its coverage, prohibits the exercise of, or is
523+conditioned on the non-exercise of one or more of the rights that are
524+specifically granted under this License. You may not convey a covered
525+work if you are a party to an arrangement with a third party that is
526+in the business of distributing software, under which you make payment
527+to the third party based on the extent of your activity of conveying
528+the work, and under which the third party grants, to any of the
529+parties who would receive the covered work from you, a discriminatory
530+patent license (a) in connection with copies of the covered work
531+conveyed by you (or copies made from those copies), or (b) primarily
532+for and in connection with specific products or compilations that
533+contain the covered work, unless you entered into that arrangement,
534+or that patent license was granted, prior to 28 March 2007.
535+
536+ Nothing in this License shall be construed as excluding or limiting
537+any implied license or other defenses to infringement that may
538+otherwise be available to you under applicable patent law.
539+
540+ 12. No Surrender of Others' Freedom.
541+
542+ If conditions are imposed on you (whether by court order, agreement or
543+otherwise) that contradict the conditions of this License, they do not
544+excuse you from the conditions of this License. If you cannot convey a
545+covered work so as to satisfy simultaneously your obligations under this
546+License and any other pertinent obligations, then as a consequence you may
547+not convey it at all. For example, if you agree to terms that obligate you
548+to collect a royalty for further conveying from those to whom you convey
549+the Program, the only way you could satisfy both those terms and this
550+License would be to refrain entirely from conveying the Program.
551+
552+ 13. Use with the GNU Affero General Public License.
553+
554+ Notwithstanding any other provision of this License, you have
555+permission to link or combine any covered work with a work licensed
556+under version 3 of the GNU Affero General Public License into a single
557+combined work, and to convey the resulting work. The terms of this
558+License will continue to apply to the part which is the covered work,
559+but the special requirements of the GNU Affero General Public License,
560+section 13, concerning interaction through a network will apply to the
561+combination as such.
562+
563+ 14. Revised Versions of this License.
564+
565+ The Free Software Foundation may publish revised and/or new versions of
566+the GNU General Public License from time to time. Such new versions will
567+be similar in spirit to the present version, but may differ in detail to
568+address new problems or concerns.
569+
570+ Each version is given a distinguishing version number. If the
571+Program specifies that a certain numbered version of the GNU General
572+Public License "or any later version" applies to it, you have the
573+option of following the terms and conditions either of that numbered
574+version or of any later version published by the Free Software
575+Foundation. If the Program does not specify a version number of the
576+GNU General Public License, you may choose any version ever published
577+by the Free Software Foundation.
578+
579+ If the Program specifies that a proxy can decide which future
580+versions of the GNU General Public License can be used, that proxy's
581+public statement of acceptance of a version permanently authorizes you
582+to choose that version for the Program.
583+
584+ Later license versions may give you additional or different
585+permissions. However, no additional obligations are imposed on any
586+author or copyright holder as a result of your choosing to follow a
587+later version.
588+
589+ 15. Disclaimer of Warranty.
590+
591+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599+
600+ 16. Limitation of Liability.
601+
602+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610+SUCH DAMAGES.
611+
612+ 17. Interpretation of Sections 15 and 16.
613+
614+ If the disclaimer of warranty and limitation of liability provided
615+above cannot be given local legal effect according to their terms,
616+reviewing courts shall apply local law that most closely approximates
617+an absolute waiver of all civil liability in connection with the
618+Program, unless a warranty or assumption of liability accompanies a
619+copy of the Program in return for a fee.
620+
621+ END OF TERMS AND CONDITIONS
622+
623+ How to Apply These Terms to Your New Programs
624+
625+ If you develop a new program, and you want it to be of the greatest
626+possible use to the public, the best way to achieve this is to make it
627+free software which everyone can redistribute and change under these terms.
628+
629+ To do so, attach the following notices to the program. It is safest
630+to attach them to the start of each source file to most effectively
631+state the exclusion of warranty; and each file should have at least
632+the "copyright" line and a pointer to where the full notice is found.
633+
634+ <one line to give the program's name and a brief idea of what it does.>
635+ Copyright (C) <year> <name of author>
636+
637+ This program is free software: you can redistribute it and/or modify
638+ it under the terms of the GNU General Public License as published by
639+ the Free Software Foundation, either version 3 of the License, or
640+ (at your option) any later version.
641+
642+ This program is distributed in the hope that it will be useful,
643+ but WITHOUT ANY WARRANTY; without even the implied warranty of
644+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
645+ GNU General Public License for more details.
646+
647+ You should have received a copy of the GNU General Public License
648+ along with this program. If not, see <https://www.gnu.org/licenses/>.
649+
650+Also add information on how to contact you by electronic and paper mail.
651+
652+ If the program does terminal interaction, make it output a short
653+notice like this when it starts in an interactive mode:
654+
655+ <program> Copyright (C) <year> <name of author>
656+ This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657+ This is free software, and you are welcome to redistribute it
658+ under certain conditions; type `show c' for details.
659+
660+The hypothetical commands `show w' and `show c' should show the appropriate
661+parts of the General Public License. Of course, your program's commands
662+might be different; for a GUI interface, you would use an "about box".
663+
664+ You should also get your employer (if you work as a programmer) or school,
665+if any, to sign a "copyright disclaimer" for the program, if necessary.
666+For more information on this, and how to apply and follow the GNU GPL, see
667+<https://www.gnu.org/licenses/>.
668+
669+ The GNU General Public License does not permit incorporating your program
670+into proprietary programs. If your program is a subroutine library, you
671+may consider it more useful to permit linking proprietary applications with
672+the library. If this is what you want to do, use the GNU Lesser General
673+Public License instead of this License. But first, please read
674+<https://www.gnu.org/licenses/why-not-lgpl.html>.
A README.md View
@@ -0,0 +1,141 @@
1+# Ferrenium
2+
3+A read-only Git repository browser, like cgit, as a single Rust daemon. It
4+serves every bare repository under one directory and keeps no state on disk.
5+
6+Pages: repo index, summary + README, tree, file (highlighted), raw, log
7+(path filter, message search), commit + diff, `.patch`, blame, refs, file
8+finder, `.tar.gz`/`.zip` snapshots, Atom feed. `git clone` over HTTPS
9+(read-only).
10+
11+## Install
12+
13+On a Linux host with systemd (x86_64 or aarch64, glibc 2.28+):
14+
15+```sh
16+curl -fsSL https://github.com/krolyxon/ferrenium/releases/latest/download/install.sh | sudo FERRENIUM_DOMAIN=git.example.com sh
17+```
18+
19+This:
20+
21+- downloads the latest release binary, verifies its checksum and installs it to `/usr/local/bin/ferrenium`
22+- creates the `git` user if it doesn't exist (home `/home/git`, shell `git-shell`)
23+- writes `/etc/ferrenium/ferrenium.toml` (never overwritten on later runs)
24+- installs `/etc/systemd/system/ferrenium.service` and runs `systemctl enable --now ferrenium`
25+
26+Variables: `FERRENIUM_DOMAIN` (fills `base_url` and clone URLs in a new
27+config), `FERRENIUM_USER` (default `git`), `FERRENIUM_VERSION` (e.g.
28+`v0.1.0`, default latest).
29+
30+Run the same command again to upgrade: it replaces the binary and unit
31+and restarts the service. To remove it: `… | sudo sh -s -- --uninstall`.
32+This keeps `/etc/ferrenium` and the repositories.
33+
34+### The service
35+
36+It's a normal system service. The unit has `User=git`, so systemd starts it
37+as the repo owner. You don't need `su git` or `systemctl --user`.
38+
39+```sh
40+sudo systemctl status ferrenium
41+sudo systemctl reload ferrenium # after editing the config
42+sudo journalctl -u ferrenium -f
43+sudo systemctl edit ferrenium # overrides; survive upgrades
44+```
45+
46+The unit is sandboxed: the filesystem is read-only, there are no
47+capabilities, a syscall filter applies, and only localhost may connect.
48+
49+### Reverse proxy
50+
51+Ferrenium listens on `127.0.0.1:8080` (plain HTTP/1.1). Caddy:
52+
53+```caddy
54+git.example.com {
55+ reverse_proxy 127.0.0.1:8080
56+}
57+```
58+
59+If Caddy runs in Docker, use `network_mode: host` so it can reach
60+`127.0.0.1`.
61+
62+### Repositories
63+
64+Put bare repositories anywhere under `/home/git` (up to 3 levels deep).
65+Ferrenium picks up new repos and pushes within about a second.
66+
67+```sh
68+sudo -u git git init --bare /home/git/project.git
69+git push git@git.example.com:project.git main # after adding your key to /home/git/.ssh/authorized_keys
70+```
71+
72+## Configuration
73+
74+Edit `/etc/ferrenium/ferrenium.toml`. Every key is optional and unknown
75+keys are errors. The file lists all keys with their defaults
76+(`ferrenium example config` prints the same). To validate the config and
77+list the repositories it finds:
78+
79+```sh
80+ferrenium check --config /etc/ferrenium/ferrenium.toml
81+```
82+
83+`listen`, `base_path`, `compression`, `cache.size_mb` and the `limits.*_parallel`/`max_requests`
84+settings need a restart; everything else applies on reload.
85+
86+Per-repository metadata comes from the first source that sets it:
87+
88+1. `[[repo]]` in the config (`name`, `description`, `section`, `owner`, `hidden`, `readme`, `default_branch`)
89+2. the repo's git config: `ferrenium.{description,owner,section,hidden,readme}`, or the gitweb/cgit keys
90+3. the repo's `description` file
91+
92+```sh
93+sudo -u git git -C /home/git/secret.git config ferrenium.hidden true
94+```
95+
96+### Limits
97+
98+Defaults are sized for a small VPS:
99+
100+| Key | Default | |
101+|---|---|---|
102+| `limits.git_parallel` | CPUs, max 8 | concurrent git work |
103+| `limits.heavy_parallel` | 2 | concurrent blame / archive / clone / log search |
104+| `limits.heavy_wait_secs` | 10 | queue time for those before `503` |
105+| `limits.max_requests` | 512 | in-flight requests before `503` |
106+| `limits.request_timeout_secs` | 30 | until the response starts |
107+| `limits.diff_files` / `diff_lines` | 300 / 10000 | larger diffs are truncated |
108+| `ui.max_blob_kb` / `max_highlight_kb` | 1024 / 256 | larger files: raw link / no highlighting |
109+| `cache.size_mb` | 64 | in-memory cache |
110+
111+`/robots.txt` keeps crawlers off the expensive pages. Memory use at idle is
112+about 10 MB.
113+
114+## Building from source
115+
116+Requires Rust 1.89+.
117+
118+```sh
119+cargo build --release # target/release/ferrenium
120+ferrenium example config|systemd|caddy
121+```
122+
123+## Development
124+
125+```sh
126+cargo test # needs the git CLI
127+cargo test --release
128+cargo clippy --all-targets -- -D warnings
129+cargo run -- serve --config dev.toml
130+tools/gen-languages/gen.py # regenerate the Linguist language table
131+```
132+
133+To release: bump `version` in `Cargo.toml`, commit, then push a `vX.Y.Z` tag.
134+The `release` workflow tests, builds x86_64 and aarch64 binaries, and
135+publishes them with `install.sh` and `SHA256SUMS`.
136+
137+## License
138+
139+GPL-3.0 (see `LICENSE`). Bundled fonts (Doto, Space Grotesk, Space Mono)
140+are licensed under the OFL; see `assets/fonts/OFL.txt`. Icons come from
141+Lucide (ISC license).
M dist/Caddyfile View
@@ -1,4 +1,4 @@
1−git.krolyxon.com {
1+git.example.com {
22 reverse_proxy 127.0.0.1:8080
33 # or, with listen = "unix:/run/ferrenium/ferrenium.sock":
44 # reverse_proxy unix//run/ferrenium/ferrenium.sock
M dist/ferrenium.service View
@@ -14,11 +14,15 @@ Group=git
1414 RuntimeDirectory=ferrenium
1515 RuntimeDirectoryMode=0755
1616
17−# Read-only sandbox: ferrenium never writes to disk.
17+# Read-only sandbox: ferrenium never writes to disk. Check the result with
18+# `systemd-analyze security ferrenium.service`.
1819 ProtectSystem=strict
20+# The repositories live in /home/git. With a scan_path outside /home, use
21+# ProtectHome=yes instead.
1922 ProtectHome=read-only
2023 PrivateTmp=yes
2124 PrivateDevices=yes
25+DevicePolicy=closed
2226 ProtectKernelTunables=yes
2327 ProtectKernelModules=yes
2428 ProtectKernelLogs=yes
@@ -37,7 +41,15 @@ LockPersonality=yes
3741 MemoryDenyWriteExecute=yes
3842 SystemCallArchitectures=native
3943 SystemCallFilter=@system-service
44+SystemCallFilter=~@privileged @resources
45+SystemCallErrorNumber=EPERM
4046 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
47+# Only the reverse proxy on this host talks to ferrenium, and ferrenium
48+# opens no outbound connections. Widen this if Caddy runs elsewhere.
49+IPAddressDeny=any
50+IPAddressAllow=localhost
51+RemoveIPC=yes
52+UMask=0077
4153
4254 [Install]
4355 WantedBy=multi-user.target
M dist/ferrenium.toml View
@@ -1,18 +1,19 @@
11 # Ferrenium configuration. Every key is optional; the values shown are the
2−# defaults unless noted. Unknown keys are an error — run `ferrenium check`.
2+# defaults unless noted. Unknown keys are an error: run `ferrenium check`.
33 # Relative paths are resolved against the directory of this file.
4+# Apply changes with `systemctl reload ferrenium`.
45
56 [server]
67 listen = "127.0.0.1:8080" # or "unix:/run/ferrenium/ferrenium.sock"
7−base_url = "https://git.krolyxon.com" # used for absolute URLs (feeds, clone URLs); default: unset
8+# base_url = "https://git.example.com" # for absolute URLs (feeds); default: http://{Host header}
89 base_path = "/" # serve under a sub-path, e.g. "/git/"
910 trusted_proxy = true # log X-Forwarded-For; default: false
10−compression = true # gzip + brotli
11+compression = true # gzip
1112
1213 [site]
13−title = "krolyxon" # default: "ferrenium"
14−description = "Personal git repositories"
15−clone_urls = ["https://git.krolyxon.com/{name}", "git@git.krolyxon.com:{name}"]
14+title = "ferrenium"
15+# description = "Personal git repositories"
16+# clone_urls = ["https://git.example.com/{name}", "git@git.example.com:{name}"]
1617 # custom_css = "custom.css"
1718 # header = "header.html"
1819 # footer = "footer.html"
@@ -32,7 +33,7 @@ https_clone = true
3233 # name = "dotfiles"
3334 # description = "My dotfiles"
3435 # section = "config"
35−# owner = "krolyxon"
36+# owner = "me"
3637 # hidden = false
3738 # readme = "docs/README.md"
3839 # default_branch = "main"
@@ -53,9 +54,11 @@ debounce_ms = 500
5354 poll_interval_secs = 300 # 0 disables the periodic full rescan
5455
5556 [limits]
56−git_parallel = 0 # 0 = 2 × CPUs
57−heavy_parallel = 2
58−request_timeout_secs = 30
57+git_parallel = 0 # 0 = CPUs, at most 8
58+heavy_parallel = 2 # blame, archives, clones and log searches at once
59+heavy_wait_secs = 10 # queue time for a heavy permit before a 503
60+max_requests = 512 # requests in flight; more get an immediate 503
61+request_timeout_secs = 30 # until the response starts; streamed bodies are not cut
5962 log_scan = 10000 # commits examined per page by path/grep log filters
6063 diff_files = 300 # larger commits show the file list only
6164 diff_lines = 10000 # changed lines rendered per commit
A dist/install.sh View
@@ -0,0 +1,146 @@
1+#!/bin/sh
2+# Install or upgrade Ferrenium from its GitHub releases.
3+#
4+# curl -fsSL https://github.com/krolyxon/ferrenium/releases/latest/download/install.sh | sudo sh
5+#
6+# Options, as environment variables (put them after `sudo`):
7+# FERRENIUM_DOMAIN=git.example.com fill in base_url and clone URLs (fresh config only)
8+# FERRENIUM_USER=git user that owns the repositories (created if missing)
9+# FERRENIUM_VERSION=v0.1.0 a specific release instead of the latest
10+#
11+# `sh -s -- --uninstall` removes the binary and the unit, and keeps
12+# /etc/ferrenium, the user and the repositories.
13+#
14+# Upgrades replace the binary and the unit and restart the service; the
15+# config is never overwritten. Customize the unit with `systemctl edit
16+# ferrenium`, not by editing the file.
17+
18+set -eu
19+
20+REPO=krolyxon/ferrenium
21+BIN=/usr/local/bin/ferrenium
22+ETC=/etc/ferrenium
23+CONFIG=$ETC/ferrenium.toml
24+UNIT=/etc/systemd/system/ferrenium.service
25+
26+say() { printf '%s\n' "$*"; }
27+die() { printf 'ferrenium install: %s\n' "$*" >&2; exit 1; }
28+has() { command -v "$1" >/dev/null 2>&1; }
29+
30+fetch() {
31+ if has curl; then
32+ curl -fsSL -o "$2" "$1"
33+ elif has wget; then
34+ wget -qO "$2" "$1"
35+ else
36+ die "curl or wget is required"
37+ fi
38+}
39+
40+uninstall() {
41+ if [ -d /run/systemd/system ]; then
42+ systemctl disable --now ferrenium 2>/dev/null || true
43+ fi
44+ rm -f "$UNIT" "$BIN"
45+ if [ -d /run/systemd/system ]; then
46+ systemctl daemon-reload
47+ fi
48+ say "Removed $BIN and $UNIT. Kept $ETC and the repositories."
49+}
50+
51+main() {
52+ [ "$(id -u)" -eq 0 ] || die "run as root (… | sudo sh)"
53+ if [ "${1:-}" = "--uninstall" ]; then
54+ uninstall
55+ return
56+ fi
57+
58+ [ "$(uname -s)" = Linux ] || die "only Linux is supported"
59+ case "$(uname -m)" in
60+ x86_64 | amd64) arch=x86_64 ;;
61+ aarch64 | arm64) arch=aarch64 ;;
62+ *) die "no release build for $(uname -m); build from source instead" ;;
63+ esac
64+ has sha256sum || die "sha256sum is required"
65+ has git || say "warning: git is not installed; HTTPS clone needs it (apt install git)"
66+
67+ version=${FERRENIUM_VERSION:-latest}
68+ if [ -n "${FERRENIUM_BASE_URL:-}" ]; then
69+ base=$FERRENIUM_BASE_URL
70+ elif [ "$version" = latest ]; then
71+ base=https://github.com/$REPO/releases/latest/download
72+ else
73+ base=https://github.com/$REPO/releases/download/$version
74+ fi
75+ asset=ferrenium-$arch-linux.tar.gz
76+
77+ tmp=$(mktemp -d)
78+ trap 'rm -rf "$tmp"' EXIT
79+ say "Downloading $asset ($version)"
80+ fetch "$base/$asset" "$tmp/$asset" || die "download failed: $base/$asset"
81+ fetch "$base/SHA256SUMS" "$tmp/SHA256SUMS" || die "download failed: $base/SHA256SUMS"
82+ (cd "$tmp" && grep " $asset\$" SHA256SUMS | sha256sum -c - >/dev/null) ||
83+ die "checksum mismatch for $asset"
84+ tar -xzf "$tmp/$asset" -C "$tmp" ferrenium
85+ "$tmp/ferrenium" --version >/dev/null 2>&1 ||
86+ die "the downloaded binary does not run here (needs glibc 2.28 or newer)"
87+
88+ # The service runs as the user that owns the repositories.
89+ user=${FERRENIUM_USER:-git}
90+ if ! id "$user" >/dev/null 2>&1; then
91+ shell=$(command -v git-shell || echo /usr/sbin/nologin)
92+ useradd --system --create-home --home-dir "/home/$user" --shell "$shell" "$user"
93+ say "Created user $user (home /home/$user, shell $shell)"
94+ fi
95+ group=$(id -gn "$user")
96+ home=$(getent passwd "$user" | cut -d: -f6)
97+
98+ install -m 755 "$tmp/ferrenium" "$BIN.new"
99+ mv -f "$BIN.new" "$BIN"
100+ say "Installed $("$BIN" --version) to $BIN"
101+
102+ if [ -e "$CONFIG" ]; then
103+ say "Kept $CONFIG"
104+ else
105+ mkdir -p "$ETC"
106+ "$BIN" example config | sed "s|^scan_path = .*|scan_path = \"$home\"|" >"$tmp/config"
107+ if [ -n "${FERRENIUM_DOMAIN:-}" ]; then
108+ d=$FERRENIUM_DOMAIN
109+ sed -i \
110+ -e "s|^# base_url = .*|base_url = \"https://$d\"|" \
111+ -e "s|^# clone_urls = .*|clone_urls = [\"https://$d/{name}\", \"$user@$d:{name}\"]|" \
112+ "$tmp/config"
113+ fi
114+ install -m 644 "$tmp/config" "$CONFIG"
115+ say "Wrote $CONFIG"
116+ fi
117+
118+ fresh=yes
119+ [ -e "$UNIT" ] && fresh=no
120+ "$BIN" example systemd |
121+ sed -e "s/^User=.*/User=$user/" -e "s/^Group=.*/Group=$group/" >"$tmp/unit"
122+ install -m 644 "$tmp/unit" "$UNIT"
123+
124+ if [ ! -d /run/systemd/system ]; then
125+ say "systemd is not running; start it yourself:"
126+ say " $BIN serve --config $CONFIG"
127+ return
128+ fi
129+ systemctl daemon-reload
130+ "$BIN" check --config "$CONFIG" >/dev/null || die "$CONFIG is invalid; fix it, then run: systemctl enable --now ferrenium"
131+ if [ "$fresh" = yes ]; then
132+ systemctl enable --now ferrenium
133+ say "Started ferrenium.service"
134+ elif systemctl is-active --quiet ferrenium; then
135+ systemctl restart ferrenium
136+ say "Restarted ferrenium.service"
137+ fi
138+
139+ say ""
140+ say "Repositories: bare repos under $home"
141+ say "Config: $CONFIG (then: systemctl reload ferrenium)"
142+ say "Logs: journalctl -u ferrenium"
143+ say "Proxy: ferrenium example caddy"
144+}
145+
146+main "$@"
M src/config.rs View
@@ -228,9 +228,13 @@ impl Default for WatchConfig {
228228 #[derive(Debug, Clone, Deserialize)]
229229 #[serde(deny_unknown_fields, default)]
230230 pub struct LimitsConfig {
231− /// 0 = 2 × available CPUs.
231+ /// 0 = available CPUs, at most 8.
232232 pub git_parallel: usize,
233233 pub heavy_parallel: usize,
234+ /// Seconds a heavy request may wait for a permit before a 503.
235+ pub heavy_wait_secs: u64,
236+ /// Requests in flight at once; more are refused with a 503.
237+ pub max_requests: usize,
234238 pub request_timeout_secs: u64,
235239 /// Commits a filtered log (path or grep) examines per page.
236240 pub log_scan: usize,
@@ -245,6 +249,8 @@ impl Default for LimitsConfig {
245249 Self {
246250 git_parallel: 0,
247251 heavy_parallel: 2,
252+ heavy_wait_secs: 10,
253+ max_requests: 512,
248254 request_timeout_secs: 30,
249255 log_scan: 10_000,
250256 diff_files: 300,
@@ -469,6 +475,9 @@ impl Config {
469475 if self.limits.heavy_parallel == 0 {
470476 errors.push("limits.heavy_parallel must be at least 1".into());
471477 }
478+ if self.limits.max_requests == 0 {
479+ errors.push("limits.max_requests must be at least 1".into());
480+ }
472481 if self.limits.request_timeout_secs == 0 {
473482 errors.push("limits.request_timeout_secs must be at least 1".into());
474483 }
@@ -501,7 +510,8 @@ impl Config {
501510 /// Effective number of concurrent git workers.
502511 pub fn git_parallel(&self) -> usize {
503512 match self.limits.git_parallel {
504− 0 => std::thread::available_parallelism().map_or(4, |n| n.get() * 2),
513+ // Git work is CPU-bound; more workers than cores only add memory.
514+ 0 => std::thread::available_parallelism().map_or(4, |n| n.get().min(8)),
505515 n => n,
506516 }
507517 }
@@ -559,7 +569,7 @@ mod tests {
559569 #[test]
560570 fn example_config_is_valid() {
561571 let c = finish(crate::examples::CONFIG).unwrap();
562− assert_eq!(c.site.title, "krolyxon");
572+ assert_eq!(c.site.title, "ferrenium");
563573 }
564574
565575 #[test]
M src/handlers/error.rs View
@@ -4,7 +4,7 @@ use std::sync::Arc;
44
55 use askama::Template;
66 use axum::extract::State;
7−use axum::http::StatusCode;
7+use axum::http::{HeaderValue, StatusCode, header};
88 use axum::response::Response;
99
1010 use super::{Layout, render};
@@ -26,7 +26,27 @@ pub fn page(state: &AppState, status: StatusCode, message: impl Into<String>) ->
2626 code,
2727 message: message.into(),
2828 };
29− render(status, &page)
29+ let mut res = render(status, &page);
30+ if status.is_server_error() {
31+ res.headers_mut()
32+ .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
33+ }
34+ res
35+}
36+
37+/// 503 for load shedding; clients may retry shortly.
38+pub fn busy(state: &AppState) -> Response {
39+ let mut res = page(state, StatusCode::SERVICE_UNAVAILABLE, "SERVER BUSY");
40+ res.headers_mut()
41+ .insert(header::RETRY_AFTER, HeaderValue::from_static("10"));
42+ res
43+}
44+
45+pub fn method_not_allowed(state: &AppState) -> Response {
46+ let mut res = page(state, StatusCode::METHOD_NOT_ALLOWED, "METHOD NOT ALLOWED");
47+ res.headers_mut()
48+ .insert(header::ALLOW, HeaderValue::from_static("GET, HEAD"));
49+ res
3050 }
3151
3252 pub async fn not_found(State(state): State<Arc<AppState>>) -> Response {
M src/server/clone.rs View
@@ -23,6 +23,9 @@ use crate::state::AppState;
2323
2424 /// CGI response headers larger than this are an error.
2525 const MAX_HEADER_BYTES: usize = 64 * 1024;
26+/// Fetch negotiations larger than this are refused (about a million
27+/// `have` lines; a normal clone sends a few kilobytes).
28+const MAX_REQUEST_BYTES: u64 = 64 * 1024 * 1024;
2629
2730 /// Whether `rest` (the path after the repository) is a clone endpoint.
2831 pub fn is_clone_path(rest: &[Vec<u8>]) -> bool {
@@ -64,8 +67,21 @@ pub async fn serve(
6467 _ => return StatusCode::METHOD_NOT_ALLOWED.into_response(),
6568 };
6669
67− let Ok(permit) = state.heavy_permits.clone().acquire_owned().await else {
68− return StatusCode::SERVICE_UNAVAILABLE.into_response();
70+ let declared = req
71+ .headers()
72+ .get(header::CONTENT_LENGTH)
73+ .and_then(|v| v.to_str().ok())
74+ .and_then(|v| v.parse::<u64>().ok());
75+ if declared.is_some_and(|n| n > MAX_REQUEST_BYTES) {
76+ return (StatusCode::PAYLOAD_TOO_LARGE, "Request too large.\n").into_response();
77+ }
78+ let Some(permit) = state.heavy_permit().await else {
79+ return (
80+ StatusCode::SERVICE_UNAVAILABLE,
81+ [(header::RETRY_AFTER, "10")],
82+ "The server is busy; try again shortly.\n",
83+ )
84+ .into_response();
6985 };
7086 let (Some(root), Some(dir)) = (repo.git_dir.parent(), repo.git_dir.file_name()) else {
7187 return StatusCode::NOT_FOUND.into_response();
@@ -128,13 +144,14 @@ pub async fn serve(
128144 return StatusCode::INTERNAL_SERVER_ERROR.into_response();
129145 };
130146
131− // Request body → stdin, then EOF.
147+ // Request body → stdin, then EOF. A body past the cap is cut off, and
148+ // git rejects the truncated request.
132149 let body = req
133150 .into_body()
134151 .into_data_stream()
135152 .map_err(std::io::Error::other);
136153 tokio::spawn(async move {
137− let mut reader = StreamReader::new(body);
154+ let mut reader = StreamReader::new(body).take(MAX_REQUEST_BYTES);
138155 if let Err(e) = tokio::io::copy(&mut reader, &mut stdin).await {
139156 tracing::debug!("clone request body: {e}");
140157 }
M src/server/dispatch.rs View
@@ -108,15 +108,15 @@ pub async fn dispatch(State(state): State<Arc<AppState>>, req: Request) -> Respo
108108 return clone::serve(state.clone(), repo, rest, req).await;
109109 }
110110 if !matches!(*req.method(), Method::GET | Method::HEAD) {
111− return StatusCode::METHOD_NOT_ALLOWED.into_response();
111+ return error::method_not_allowed(&state);
112112 }
113113 let query = Query::<PageQuery>::try_from_uri(req.uri())
114114 .map(|q| q.0)
115115 .unwrap_or_default();
116116 let heavy = if is_heavy(&rest, &query) {
117− match state.heavy_permits.clone().acquire_owned().await {
118− Ok(permit) => Some(permit),
119− Err(_) => return error::page(&state, StatusCode::SERVICE_UNAVAILABLE, "SHUTTING DOWN"),
117+ match state.heavy_permit().await {
118+ Some(permit) => Some(permit),
119+ None => return error::busy(&state),
120120 }
121121 } else {
122122 None
M src/server/headers.rs View
@@ -6,7 +6,7 @@ use tower_http::set_header::SetResponseHeaderLayer;
66 pub const PAGE_CSP: &str = "default-src 'self'; img-src 'self' https: data:; script-src 'self'; \
77 object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'";
88
9−pub fn layers() -> [SetResponseHeaderLayer<HeaderValue>; 4] {
9+pub fn layers() -> [SetResponseHeaderLayer<HeaderValue>; 5] {
1010 let set = |name: HeaderName, value: &'static str| {
1111 SetResponseHeaderLayer::if_not_present(name, HeaderValue::from_static(value))
1212 };
@@ -15,5 +15,9 @@ pub fn layers() -> [SetResponseHeaderLayer<HeaderValue>; 4] {
1515 set(header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
1616 set(header::REFERRER_POLICY, "same-origin"),
1717 set(header::X_FRAME_OPTIONS, "DENY"),
18+ set(
19+ HeaderName::from_static("cross-origin-opener-policy"),
20+ "same-origin",
21+ ),
1822 ]
1923 }
M src/server/mod.rs View
@@ -24,7 +24,6 @@ use tower_http::CompressionLevel;
2424 use tower_http::catch_panic::CatchPanicLayer;
2525 use tower_http::compression::predicate::{NotForContentType, Predicate};
2626 use tower_http::compression::{CompressionLayer, DefaultPredicate};
27−use tower_http::timeout::TimeoutLayer;
2827 use tower_http::trace::{DefaultOnResponse, TraceLayer};
2928 use tracing::Level;
3029
@@ -47,6 +46,7 @@ pub fn app(state: Arc<AppState>) -> Router {
4746 .route("/robots.txt", get(robots))
4847 .route("/{*path}", any(dispatch::dispatch))
4948 .fallback(handlers::error::not_found)
49+ .method_not_allowed_fallback(method_not_allowed)
5050 .with_state(state.clone());
5151
5252 // The prefix must be stripped *before* routing, so wrap the whole router
@@ -63,6 +63,8 @@ pub fn app(state: Arc<AppState>) -> Router {
6363 };
6464
6565 let trusted_proxy = config.server.trusted_proxy;
66+ // gzip only: brotli's window costs megabytes per response for a ~2%
67+ // smaller page.
6668 let compression = CompressionLayer::new()
6769 .no_deflate()
6870 .no_zstd()
@@ -72,7 +74,7 @@ pub fn app(state: Arc<AppState>) -> Router {
7274 let compression = if config.server.compression {
7375 compression
7476 } else {
75− compression.no_gzip().no_br()
77+ compression.no_gzip()
7678 }
7779 // Fonts, archives and packfiles are already compressed.
7880 .compress_when(
@@ -83,7 +85,8 @@ pub fn app(state: Arc<AppState>) -> Router {
8385 .and(NotForContentType::const_new("application/x-git-")),
8486 );
8587
86− let [csp, nosniff, referrer, frame] = headers::layers();
88+ let [csp, nosniff, referrer, frame, coop] = headers::layers();
89+ let panic_state = state.clone();
8790 routes.layer(
8891 ServiceBuilder::new()
8992 .layer(
@@ -103,19 +106,48 @@ pub fn app(state: Arc<AppState>) -> Router {
103106 .on_request(())
104107 .on_response(DefaultOnResponse::new().level(Level::INFO)),
105108 )
106− .layer(CatchPanicLayer::new())
107− .layer(TimeoutLayer::with_status_code(
108− StatusCode::SERVICE_UNAVAILABLE,
109− Duration::from_secs(config.limits.request_timeout_secs),
110− ))
111− .layer(compression)
109+ // Outside the panic and timeout handlers, so their pages get
110+ // the headers too.
112111 .layer(csp)
113112 .layer(nosniff)
114113 .layer(referrer)
115− .layer(frame),
114+ .layer(frame)
115+ .layer(coop)
116+ .layer(CatchPanicLayer::custom(move |_| {
117+ tracing::error!("request handler panicked");
118+ handlers::error::page(
119+ &panic_state,
120+ StatusCode::INTERNAL_SERVER_ERROR,
121+ "INTERNAL ERROR",
122+ )
123+ }))
124+ .layer(middleware::from_fn_with_state(state, shield))
125+ .layer(compression),
116126 )
117127 }
118128
129+/// Refuse requests beyond `limits.max_requests` at once, and answer with a
130+/// 503 page when a response hasn't started within
131+/// `limits.request_timeout_secs`. Streamed bodies (archives, clones) are not
132+/// cut off once they've started.
133+async fn shield(State(state): State<Arc<AppState>>, req: Request, next: Next) -> Response {
134+ let Ok(_permit) = state.request_permits.clone().try_acquire_owned() else {
135+ tracing::warn!("too many requests in flight; refusing {}", req.uri());
136+ return handlers::error::busy(&state);
137+ };
138+ let timeout = Duration::from_secs(state.config.load().limits.request_timeout_secs);
139+ match tokio::time::timeout(timeout, next.run(req)).await {
140+ Ok(res) => res,
141+ Err(_) => {
142+ handlers::error::page(&state, StatusCode::SERVICE_UNAVAILABLE, "REQUEST TIMED OUT")
143+ }
144+ }
145+}
146+
147+async fn method_not_allowed(State(state): State<Arc<AppState>>) -> Response {
148+ handlers::error::method_not_allowed(&state)
149+}
150+
119151 /// First address in `X-Forwarded-For` (the original client, as seen by the
120152 /// trusted proxy).
121153 fn forwarded_for(req: &Request) -> Option<&str> {
M src/state.rs View
@@ -3,9 +3,10 @@
33 use std::path::PathBuf;
44 use std::sync::Arc;
55 use std::sync::atomic::{AtomicU64, Ordering};
6+use std::time::Duration;
67
78 use arc_swap::ArcSwap;
8−use tokio::sync::Semaphore;
9+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
910
1011 use crate::cache::Cache;
1112 use crate::config::{Config, ConfigError, Listen};
@@ -21,10 +22,12 @@ pub struct AppState {
2122 pub assets: Assets,
2223 pub cache: Cache,
2324 /// Bounds concurrent git work (`limits.git_parallel`).
24− pub git_permits: Semaphore,
25+ pub git_permits: Arc<Semaphore>,
2526 /// Bounds expensive requests: blame, archives, clones, log searches
2627 /// (`limits.heavy_parallel`). Held for a whole response stream.
2728 pub heavy_permits: Arc<Semaphore>,
29+ /// Bounds requests in flight (`limits.max_requests`).
30+ pub request_permits: Arc<Semaphore>,
2831 pub index: Indexer,
2932 /// Background language statistics.
3033 pub warmer: Warmer,
@@ -54,8 +57,9 @@ impl AppState {
5457 pub fn new(config: Config, overrides: Overrides) -> Arc<Self> {
5558 Arc::new(AppState {
5659 cache: Cache::new(config.cache.size_mb),
57− git_permits: Semaphore::new(config.git_parallel()),
60+ git_permits: Arc::new(Semaphore::new(config.git_parallel())),
5861 heavy_permits: Arc::new(Semaphore::new(config.limits.heavy_parallel)),
62+ request_permits: Arc::new(Semaphore::new(config.limits.max_requests)),
5963 config_generation: AtomicU64::new(0),
6064 config: ArcSwap::from_pointee(config),
6165 assets: Assets::new(),
@@ -84,22 +88,20 @@ impl AppState {
8488 tracing::warn!("server.base_path changed; restart required to take effect");
8589 new.server.base_path = old.server.base_path.clone();
8690 }
87− if new.server.compression != old.server.compression
88− || new.limits.request_timeout_secs != old.limits.request_timeout_secs
89− {
90− tracing::warn!(
91− "server.compression / limits.request_timeout_secs changed; restart required"
92− );
91+ if new.server.compression != old.server.compression {
92+ tracing::warn!("server.compression changed; restart required");
9393 new.server.compression = old.server.compression;
94− new.limits.request_timeout_secs = old.limits.request_timeout_secs;
9594 }
9695 if new.cache.size_mb != old.cache.size_mb
9796 || new.git_parallel() != old.git_parallel()
9897 || new.limits.heavy_parallel != old.limits.heavy_parallel
98+ || new.limits.max_requests != old.limits.max_requests
9999 {
100100 tracing::warn!(
101− "cache.size_mb / limits.git_parallel / limits.heavy_parallel changed; restart required"
101+ "cache.size_mb / limits.git_parallel / limits.heavy_parallel / limits.max_requests \
102+ changed; restart required"
102103 );
104+ new.limits.max_requests = old.limits.max_requests;
103105 new.cache.size_mb = old.cache.size_mb;
104106 new.limits.git_parallel = old.limits.git_parallel;
105107 new.limits.heavy_parallel = old.limits.heavy_parallel;
@@ -110,14 +112,30 @@ impl AppState {
110112 Ok(new)
111113 }
112114
115+ /// A heavy-request permit, waiting at most `limits.heavy_wait_secs`.
116+ /// `None` when the server is too busy (or shutting down).
117+ pub async fn heavy_permit(&self) -> Option<OwnedSemaphorePermit> {
118+ let wait = Duration::from_secs(self.config.load().limits.heavy_wait_secs);
119+ match tokio::time::timeout(wait, self.heavy_permits.clone().acquire_owned()).await {
120+ Ok(Ok(permit)) => Some(permit),
121+ _ => None,
122+ }
123+ }
124+
113125 /// Run blocking git work on the blocking pool, at most
114126 /// `limits.git_parallel` jobs at a time.
115127 pub async fn blocking<T: Send + 'static>(
116128 self: &Arc<Self>,
117129 work: impl FnOnce(&AppState) -> T + Send + 'static,
118130 ) -> anyhow::Result<T> {
119− let _permit = self.git_permits.acquire().await?;
131+ // The permit moves into the job: a timed-out request stops waiting,
132+ // but the job keeps its slot until it really finishes.
133+ let permit = self.git_permits.clone().acquire_owned().await?;
120134 let state = self.clone();
121− Ok(tokio::task::spawn_blocking(move || work(&state)).await?)
135+ Ok(tokio::task::spawn_blocking(move || {
136+ let _permit = permit;
137+ work(&state)
138+ })
139+ .await?)
122140 }
123141 }
M tests/extras.rs View
@@ -88,11 +88,16 @@ struct Site {
8888
8989 /// `repos` is extra lines for the `[repos]` table.
9090 fn site(repos: &str) -> Site {
91+ site_with(repos, "")
92+}
93+
94+/// Like [`site`], with `tables` appended to the config.
95+fn site_with(repos: &str, tables: &str) -> Site {
9196 let root = tempfile::tempdir().unwrap();
9297 let f = fixture(root.path());
9398 let toml = format!(
9499 "[repos]\nscan_path = {:?}\n{repos}\n[watch]\nenabled = false\n\
95− [server]\nbase_url = \"https://git.example.com\"\n",
100+ [server]\nbase_url = \"https://git.example.com\"\n{tables}\n",
96101 root.path().to_str().unwrap()
97102 );
98103 let mut config = Config::parse(&toml).expect("parse");
@@ -388,6 +393,77 @@ async fn robots_and_methods() {
388393 );
389394 }
390395
396+#[tokio::test]
397+async fn hardening() {
398+ let s = site_with(
399+ "",
400+ "[limits]\nheavy_parallel = 1\nheavy_wait_secs = 0\nmax_requests = 4",
401+ );
402+
403+ // Error pages are styled and carry the security headers.
404+ for res in [
405+ request(&s.app, Method::POST, "/").await,
406+ request(&s.app, Method::DELETE, "/ext/tree/main").await,
407+ ] {
408+ assert_eq!(res.status, StatusCode::METHOD_NOT_ALLOWED);
409+ assert_eq!(res.headers[header::ALLOW], "GET, HEAD");
410+ assert!(res.text().contains("[ERROR: METHOD NOT ALLOWED]"));
411+ }
412+ let res = get(&s.app, "/nope/nothing").await;
413+ assert_eq!(res.status, StatusCode::NOT_FOUND);
414+ assert!(res.text().contains("[ERROR: PAGE NOT FOUND]"));
415+ for name in [
416+ "content-security-policy",
417+ "x-content-type-options",
418+ "referrer-policy",
419+ "x-frame-options",
420+ "cross-origin-opener-policy",
421+ ] {
422+ assert!(res.headers.contains_key(name), "missing {name}");
423+ }
424+
425+ // Heavy pages give up after `heavy_wait_secs`; others are unaffected.
426+ let held = s.state.heavy_permits.clone().try_acquire_owned().unwrap();
427+ let res = get(&s.app, "/ext/blame/main/src/main.rs").await;
428+ assert_eq!(res.status, StatusCode::SERVICE_UNAVAILABLE);
429+ assert_eq!(res.headers[header::RETRY_AFTER], "10");
430+ assert_eq!(res.headers[header::CACHE_CONTROL], "no-store");
431+ assert!(res.text().contains("[ERROR: SERVER BUSY]"));
432+ assert_eq!(
433+ get(&s.app, "/ext/info/refs?service=git-upload-pack")
434+ .await
435+ .status,
436+ StatusCode::SERVICE_UNAVAILABLE
437+ );
438+ ok(&s.app, "/ext/tree/main").await;
439+ drop(held);
440+ ok(&s.app, "/ext/blame/main/src/main.rs").await;
441+
442+ // Past `max_requests`, everything is refused at once.
443+ let held = s
444+ .state
445+ .request_permits
446+ .clone()
447+ .try_acquire_many_owned(4)
448+ .unwrap();
449+ assert_eq!(
450+ get(&s.app, "/").await.status,
451+ StatusCode::SERVICE_UNAVAILABLE
452+ );
453+ drop(held);
454+ ok(&s.app, "/").await;
455+
456+ // Oversized fetch negotiations never reach git.
457+ let req = Request::builder()
458+ .method(Method::POST)
459+ .uri("/ext.git/git-upload-pack")
460+ .header(header::CONTENT_LENGTH, "1000000000")
461+ .body(Body::empty())
462+ .unwrap();
463+ let res = s.app.clone().oneshot(req).await.unwrap();
464+ assert_eq!(res.status(), StatusCode::PAYLOAD_TOO_LARGE);
465+}
466+
391467 #[tokio::test(flavor = "multi_thread")]
392468 async fn clone_over_https() {
393469 let s = site("");
M tests/http.rs View
@@ -203,7 +203,7 @@ async fn compression_skips_fonts() {
203203 .oneshot(req(format!("/-/static/{hash}/css/app.css")))
204204 .await
205205 .unwrap();
206− assert_eq!(res.headers()[header::CONTENT_ENCODING], "br");
206+ assert_eq!(res.headers()[header::CONTENT_ENCODING], "gzip");
207207 let res = app
208208 .clone()
209209 .oneshot(req(format!(