Can hg serve enforce deny‑by‑default anonymous read access without external auth?

Answer

Yes. Mercurial’s built‑in hg serve can reject all anonymous read requests by setting deny_read = * in the repository’s [web] section. The rule applies to any request where REMOTE_USER is empty or not supplied, which is the case for anonymous clients. Authorized users must be listed in allow_read to override the denial.

Explanation

The [web] section evaluates deny_read before allow_read. When deny_read = * matches every username (including the empty string for anonymous), the request is denied unless an explicit allow_read entry matches the REMOTE_USER value. Mercurial itself does not perform authentication; it relies on the front‑end or proxy to set REMOTE_USER. If no authentication layer is present, all reads are blocked.

Configuration steps

1. Edit or create the repository’s .hg/hgrc file and add:

   [web]
   deny_read = *
   allow_read = alice, bob
   

2. Start the server:

   hg serve -R /path/to/repo
   

3. Ensure your authentication front‑end (e.g., Apache, Nginx, or a custom proxy) sets the REMOTE_USER environment variable to the authenticated username before invoking hg serve. If REMOTE_USER is unset or empty, the request is treated as anonymous and will be denied.

Verification

• Anonymous clone (no REMOTE_USER): hg clone http://localhost:8000/repo → permission denied.
• Authorized clone: export REMOTE_USER=alice then hg clone http://localhost:8000/repo → succeeds.
• Disallowed user: export REMOTE_USER=charlie then clone → permission denied.