title: Gitolite doesn't respect rules when accessed through httpd
body: <p>I convinced the office that we should move to Git. Because we're just starting, I set up a git server using plain git and https in front of it using nginx. We <em>don't</em> use gitlab or something like that - for now.</p>
  
  <p>One of the questions I got is whether it would be possible to restrict access to specific branches (especially master) for new colleagues. It would have saved us a lot of trouble in the past :-)</p>
  
  <p>During my search for a solution, I found <a href="http://gitolite.com/gitolite/index.html" rel="nofollow">gitolite</a> very promising so I tried it out and set it up. I got git up and running through gitolite so I started to dig into the rules.</p>
  
  <p>However, I cannot get them right. It seems like gitolite ignores <a href="http://gitolite.com/gitolite/gitolite.html#access-control-rule-matching" rel="nofollow">the second check</a></p>
  
  <p>My <code>gitlolite-admin/conf/gitolite.conf</code> looks like this (I had a more complex one but while debugging I stripped it down to the bare minimum)</p>
  
  <pre><code>@starters   =   auric
  
  # project groups
  @protected  =   master$
  
  repo gitolite-admin
      RW+     =   admin
  
  repo testing
      RW+     =   @all
  
  repo playground
      R                =   @starters       # allow read from protected
      -   @protected   =   @starters       # deny anything else
      RW+              =   @starters       # allow everything on other branches
  </code></pre>
  
  <p>In the docs it is specified that you can <a href="http://gitolite.com/gitolite/gitolite.html#tracing-the-access-control-decision" rel="nofollow">trace the access control decision</a>.</p>
  
  <p>output of <code>gitolite access -s playground auric</code> is this</p>
  
  <p><strong>pull access</strong></p>
  
  <pre><code>$ gitolite access -s playground auric R master
  legend:
      d =&gt; skipped deny rule due to ref unknown or 'any',
      r =&gt; skipped due to refex not matching,
      p =&gt; skipped due to perm (W, +, etc) not matching,
      D =&gt; explicitly denied,
      A =&gt; explicitly allowed,
      F =&gt; denied due to fallthru (no rules matched)
  
    A        gitolite.conf:14         R                =   @starters       # allow read from protected
  
  refs/.*
  </code></pre>
  
  <p><strong>push access</strong></p>
  
  <pre><code>$ gitolite access -s playground auric W master
  
    p        gitolite.conf:14         R                =   @starters       # allow read from protected
    D        gitolite.conf:15         -   @protected   =   @starters       # deny anything else
  
  W refs/heads/master playground auric DENIED by refs/heads/master$
  </code></pre>
  
  <p><strong>rewind push access</strong></p>
  
  <pre><code>$ gitolite access -s playground auric + master
    p        gitolite.conf:14         R                =   @starters       # allow read from protected
    D        gitolite.conf:15         -   @protected   =   @starters       # deny anything else
  
  + refs/heads/master playground bert.van.dooren DENIED by refs/heads/master$
  </code></pre>
  
  <p><strong>push access on another branch</strong></p>
  
  <pre><code>$ gitolite access -s playground bert.van.dooren W anyotherbranch
    p        gitolite.conf:14         R                =   @starters       # allow read from protected
    r        gitolite.conf:15         -   @protected   =   @starters       # deny anything else
    A        gitolite.conf:16         RW+              =   @starters       # allow everything on other branches
  
  refs/.*
  </code></pre>
  
  <p>exactly what I expected it to be.
  and indeed, this is what I see in <code>~/.gitolite/logs</code> after executing these commands (I stripped the date here):</p>
  
  <pre><code>32205   cli     gitolite        access  -s      playground      auric W       master
  32205           system,/home/git/gitolite/src/commands/access,-s,playground,auric,W,master
  32205           system() failed,/home/git/gitolite/src/commands/access,-s,playground,auric,W,master,-&gt; 256
  </code></pre>
  
  <p>However, when I actually start using git and perform a push (and even a rewind push) through httpd, all commands are allowed and I see this in the logs</p>
  
  <pre><code>32196   http    ARGV=auric    SOC=git-receive-pack 'playground.git'   FROM=10.0.13.105
  32196   pre_git playground      auric W       any     refs/.*
  32196           system,git,http-backend
  32196   END
  </code></pre>
  
  <p>as if only check 1 is done but check 2 never comes. </p>
  
  <p>What do I miss here?</p>
  
  <p><strong>edit</strong> I'm using gitolite3. I know some answers are around about adding the rule <code>R   master   =   @starters</code> but then gitolite gives me the warning that that rule doesn't make any sense. It is ignored.</p>