# Sample configuration file for rush.
# Copyright (C) 2008-2025 Sergey Poznyakoff
#
# GNU Rush is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3, or (at your option)
# any later version.
#
# GNU Rush is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

# Lines beginning with # and empty lines are ignored.
# See `info rush' for a detailed description.

rush 2.0

global
  # Set verbosity level. 
  debug 1

rule default
  limits t10r20
  umask 002
  clrenv
  keepenv USER LOGNAME HOME PATH
  setenv PATH="$PATH:/usr/local/bin"
  fall-through

rule cvs
  match $command ~ "^cvs server"
  set [0] = "/usr/bin/cvs"

# Secure cp requests
rule scp-to
  match $command ~ "^scp (-v )?-t /incoming/(alpha|ftp)"
  set [0] = "/bin/scp"
  chroot "/var/spool/sftp-upload"
  chdir "/incoming"

# A trap rule for outbound scp requests
rule scp-from
  match $command ~ "^scp (-v )?-f"
  exit "Error: Secure copy from this server is not allowed"
  
# Svn server: force full binary path and root directory.  
rule svn
  match $command ~ "^svnserve -t"
  set program = "/usr/bin/svnserve"
  remopt r:
  insert [1] = "-r"
  insert [2] = "/svnroot"

# For git requests, allow access to repositories located under
# /vcs-roots/git
rule git
  match $command ~ "^git-(receive|upload)-pack"
  match $1 ~ "^/vcs-roots/git/[^ ]+\\.git$"
  set command =~ "s|^|/usr/bin/|"
  
# Trap the rest of Git requests:
rule git-trap
  match $command ~ "^git-(receive|upload)-pack"
  exit "fatal: access to this repository is denied."
  
# Sftp-server requests: chroot into the user's home directory, set umask
# 002 and execute bin/sftp-server.
rule sftp
  match $program ~ "^.*/sftp-server"
  set [0] = "bin/sftp-server"
  umask 002
  chroot "~"
  chdir "/"

