Hello Manuel,

Indeed, the contrib does not make sens. Hiding the "$git_http_url" variable within plugin conf will hide the clone URL wile replication over http works like a charm.

I'll set the contrib "abandoned" in gerrit.

Thanks and best regards,
Ahmed

Ok, I undestand the use case but I don't understand why you need a specific patch, just uncommenting the variable or setting it to an empty string already hide the entry

Hello Manuel,

On a daily basis, we are facing a Huge CPU load on Codex due to high system usage. When troubleshooting such issue, it's always related to git.
We already set up few rules for memory usage, we didn't yet faced issues with disk I/O...

Apache as system component, is our single point of failure (SPOF), which would upon failure renders most of our Tuleap stack unavailable / unreliable.
We are trying to mitigate this SPOF by disabling git http transport for our users.

Even if we isolate git transport, the high usage git over ssh://would impact other non git users when server reach limits...For a better proactive protection for tuleap, we need then to blacklist "attacker's IP" using Fail2ban:

Having git available only via ssh:// would be good to setup an sshd jail configured to ban any polling user / ACI (given their IPs) for a moment; Only git/ssh access would be blocked, other Tuleap services will be available for those blacklisted IPs.


Regards,
Ahmed

I don't understand why end users shouldn't be allowed to see and use the http route.

I undestand the specific point of your gerrit setup but why is that an issue if other users are relying on http route for doing their git operations ?

Hello Tuleap Integrators,

Could you please take a llok to gerrit# 4284 ?

Best regards,
Ahmed