HelpFIT
Go to navigation

.fit-pages.yml

The following page describes how to configure the .fit-pages.yml file. Among other things, this configuration file allows you to configure access control for individual pages or branches using CTU accounts and roles.

Warning:

Newly created repositories start with a default branch named main. However, the PagesFIT service still assumes that the main repository branch is named master. You therefore need to create a branch named master and place the .fit-pages.yml file in it. We also recommend setting master as the default project branch.

The .fit-pages.yml file must be located in the root directory of the repository in the master branch and must be in YAML format (UTF-8 encoded) with the following structure [1]:

  • domain: (string, optional) – Full domain name, required only for websites outside pages.fit and courses.fit.cvut.cz.
  • access: (object)
    • <branch>: (object) – Name of the branch (or branches) to which the following rule should be applied. A pattern may be used instead of a specific name (use * for all branches). The order of rules matters – the first applicable rule wins.
      • <page-path>: (object) – Relative path of the page to which the rule should be applied. Subpages are implicitly included and do not need to be specified separately. The relative path must start with /. The order of rules matters – the first applicable rule wins.
      • allow: (array[string]) – List of basic roles (ANONYMOUS or AUTHENTICATED), business roles, or usernames.
      • deny: (array[string], optional) – List of basic roles (ANONYMOUS or AUTHENTICATED), business roles, or usernames.

A user is granted access to a page if and only if they possess at least one of the roles listed in the allow list (or their username is explicitly listed there) and at the same time do not possess any of the roles listed in the deny list (or their username is explicitly listed there). Otherwise, access is denied.

Important:
PagesFIT Access Rights vs GitLab

PagesFIT access rights are completely independent of the access rights of the source repository in GitLab! This means that if you need to restrict access to the entire website or selected sections to only a specific subset of authenticated users, and prevent access by others, you must set the visibility of the source repository to Private.

Examples

Sample .fit-pages.yml for a laboratory
domain: pages.fit.cvut.cz

access:
  master:
    /internal-documents/: 1
      allow:
        # Laboratory management
        - flynnkev
        - novakjan
        # FIT board members
        - B-18000-GREMIUM-CLEN
    /: 2
      allow:
        - B-18000-SUMA-PRACOVNIK

  "*":
    /: 3
      allow:
        - B-18000-OSOBA-CVUT
      deny:
        - eilisbill
  1. Allow access to the /internal-documents/ page (and its subpages) in the master branch for users flynnkev, novakjan, and all users with the business role B-18000-GREMIUM-CLEN.
  2. Allow access to all other pages in this branch for users with the business role B-18000-SUMA-PRACOVNIK.
  3. Allow access to all pages in all other branches for users with the business role B-18000-OSOBA-CVUT, except for user eilisbill. Access is denied to that user.
Sample .fit-pages.yml for a course
domain: courses.fit.cvut.cz

access:
  master:
    /teachers/:  1
      allow: [AUTHENTICATED]
    /:  2
      allow: [ANONYMOUS]

  B[0-9]*:
    /:  3
      allow: [AUTHENTICATED]

  '*':
    /:  4
      allow:
        - P-BI-AAG-UCITEL
        - P-BIK-AAG-UCITEL
  1. Allow access to the /teachers page and its subpages in the master branch (main branch) for all authenticated users.
  2. Allow access to all other pages in the master branch for all users, including anonymous visitors (i.e., public pages).
  3. Allow access to all pages in semester branches (e.g., B211) for all authenticated users.
  4. Allow access to all pages in all other branches (i.e., except master and semester branches) only to instructors of BI-AAG and BIK-AAG.
  1. The notation used to describe the YAML file structure is inspired by MSON. ↩