Home
Getting started
Roles & permissions (RBAC)
izihub uses layered access control: site admins, organizations, teams with unit permissions, repository collaborators, and branch protection.
1. Site
Instance admins manage users, auth, and system settings.
2. Organization
Teams map to roles. Default org is private.
3. Repository
Collaborators for one-off access; teams for ongoing work.
4. Branches
Protect main so only reviews/merges land there.
Standard organization roles
| Role | Code | Issues | PRs | Releases | Wiki | Projects | Packages | Actions | Create repos |
|---|---|---|---|---|---|---|---|---|---|
| Owners | Admin | Admin | Admin | Admin | Admin | Admin | Admin | Admin | Yes |
| Org-Admins | Admin | Admin | Admin | Admin | Admin | Admin | Admin | Admin | Yes |
| Maintainers | Write | Write | Write | Write | Write | Write | Write | Write | Yes |
| Developers | Write | Write | Write | Read | Write | Write | Read | Read | No |
| Reviewers | Read | Write | Write | Read | Read | Read | Read | Read | No |
| Reporters | None | Write | None | None | None | Read | None | None | No |
| Readers | Read | Read | Read | Read | Read | Read | Read | Read | No |
| CI-Bots | Read | Read | Read | Write | None | None | Write | Write | No |
Who should get which role?
- Site admin + Owners — platform operators (you)
- Maintainers / Org-Admins — tech leads
- Developers — engineers who push code daily
- Reviewers — QA, product, or contractors who should not push to main
- Reporters — people who only file bugs
- Readers — stakeholders who only need to browse
- CI-Bots — automation users with access tokens
How to set it up
- Create the admin — register the first account on the web UI, or run
./scripts/rbac-bootstrap.sh --create-admin --admin-user iziadmin --admin-email you@example.com - Bootstrap teams — with an admin token:
./scripts/rbac-bootstrap.sh --token YOUR_TOKEN --url http://YOUR_HOST:3000
Creates the privateizihuborg and all standard teams. - Add people to teams — Organization → Teams → add members, or
./scripts/rbac-bootstrap.sh --token … --assign alice Developers - Protect main — each repo → Settings → Branches → protect
main(require PR, block force-push). - Harden registration — for a private forge set
DISABLE_REGISTRATION=truein.envand recreate the server.
Repository collaborators (personal / exceptions)
For a single repo outside the org model:
- Read — clone, browse, open PRs
- Write — push, merge, moderate issues
- Admin — manage collaborators and settings
- Owner — transfer or delete the repository
Prefer org teams for anything ongoing so access is reviewable in one place.
Real enforcement (active)
Branch protection is applied automatically to org repositories:
- main, master, release/** — direct
git pushis denied (including admins) - Changes land only via pull request
- ≥ 1 approval required; stale approvals dismissed on new commits
- Rejected reviews and outdated branches block merge
- Only Owners / Org-Admins / Maintainers may merge
- Tags matching
v*restricted to the same teams
Policy file: rbac/enforcement.json · re-apply: ./scripts/enforce-protection.sh
A timer re-applies rules every 2 minutes so new repos are protected without manual steps.
Demo: org repo protected-demo — try pushing to main to see rejection.
Site roles
- Site admin — Site Administration panel (users, auth, runners, config)
- User — normal account
- Restricted user — only public content and repos explicitly shared (set per user in admin)