rendezvous

Documentation

Overview

Package rendezvous is a minimal authenticated git-http rendezvous server: the real external remote the {git} workspace output pushes per-attempt branches to. It speaks the git smart-HTTP protocol by shelling out to the stock `git http-backend` CGI, gated behind HTTP basic-auth whose credentials come from configuration (a Kubernetes Secret in deployment). It is the counterpart to the credentialed push in internal/workspace/git.go: that side supplies the token, this side checks it.

Security: the configured token is a secret VALUE. It is compared in constant time and is NEVER logged, never written to a response body, and never placed on a child-process argv. The git-http-backend child receives only the request over CGI env+stdin; the token is consumed by the auth check before the child runs.

Index

• type Config
• type Server
  • func New(cfg Config) (*Server, error)
  • func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

Types

type Config

type Config struct {
	// Root is the directory holding the bare git repositories. Each pushed repo
	// path "<name>.git" is created here on first push.
	Root string
	// Username is the basic-auth username the push must present. Not a secret.
	Username string
	// Token is the basic-auth password the push must present. A secret VALUE:
	// never logged, never echoed, compared in constant time.
	Token string
	// Realm is the basic-auth realm advertised in the WWW-Authenticate challenge.
	// Defaults to "mitos-rendezvous".
	Realm string
}

Config configures the rendezvous server.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is the authenticated git-http rendezvous handler.

func New

func New(cfg Config) (*Server, error)

New validates the config, discovers git, and returns the server. It returns an error (never carrying the token) when git is missing or the root is unusable.

func (*Server) ServeHTTP

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP authenticates the request, ensures the target bare repo exists, then hands the request to git-http-backend over CGI.