Fossil SCM - Distributed Version Control

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Fossil is a simple, high reliability, distributed version control system. It was created by the author of SQLite and hosts the SQLite project's own source code, and it has a track record of over a decade in production. Unlike most version control tools, Fossil bundles everything a small project needs into one self contained executable: distributed source control, a bug tracker, a wiki, a forum, a chatroom, technotes and an integrated web interface, all backed by a single SQLite database file that is the entire repository. There is nothing else to install and nothing external to run.

This AMI delivers Fossil fully installed and reverse proxied behind nginx, so a working version control server with its web UI is running within minutes of launch, with no manual package installation, no dependency troubleshooting and no proxy configuration required.

## Why This Image vs a Manual Install

Running Fossil safely yourself means fetching and verifying the official binary, standing up a service that binds only to loopback, putting a rate limiting reverse proxy in front of it to close the denial of service gap that a directly exposed server would leave open, locking anonymous access down to read only, and generating a unique administrator password per machine so no two servers share a credential. This image completes every one of those steps at build time:

• Fossil binds only to loopback and is served through an nginx reverse proxy that is ready for your TLS certificate and rate limits inbound requests
• Anonymous write is disabled so unauthenticated visitors and the built in anonymous account are restricted to read only access
• A fresh empty repository and a unique random administrator password are generated on each instance's first boot and written to a root only file

## Security Hardening

This image follows a defence in depth approach:

• No default or shared credential: no repository and no administrator password ship in the image; the build repository is deleted before capture, and a fresh empty repository plus a unique random administrator password are generated on each instance's first boot
• Loopback only backend: Fossil binds exclusively to 127.0.0.1:8081; only the nginx reverse proxy is exposed on port 80
• Rate limited front door: nginx rate limits inbound requests and caps request body size, adding the denial of service mitigation that a directly exposed Fossil server lacks
• Read only anonymous access: unauthenticated visitors and the built in anonymous account can browse and clone but cannot commit, edit the wiki or file tickets; the administrator is the only writer
• Hardened service unit: the Fossil systemd unit runs as a dedicated unprivileged system user with NoNewPrivileges, ProtectSystem=strict and a writable path restricted to its own data directory

## Concrete Use Cases

• All in one project hosting: give a small team distributed source control together with a bug tracker, wiki and forum in a single self hosted server, with nothing external to install or run
• Portable, trivially backed up repositories: the whole repository is one SQLite file, so a project's entire history, tickets and wiki back up with a single file copy or EBS snapshot
• Self hosted alternative to a hosted forge: run your own version control server with a web timeline, code browsing with syntax highlighting, tarball and ZIP downloads and cloning over HTTP, inside your own AWS account

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Front the instance with an Application Load Balancer terminating TLS with your own certificate, or add your certificate to the bundled nginx reverse proxy. Back up the single file repository with EBS snapshots or AWS Backup, and grow the root volume as your history grows.

## Getting Started

Launch the AMI, read your unique administrator password from the root only file on the instance, and log in to the Fossil web UI to create users, set capabilities, attach your TLS certificate and start pushing code. The paired cloudimg deployment guide walks through connecting over SSH, verifying the service, the secure by default settings and backup planning.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, adding your own domain and TLS certificate to the reverse proxy, managing Fossil users and capabilities, and backup planning for your repository.