Git daemon export-ok and repository visibility constraints

Git Daemon Repository Advertising

The git daemon provides a mechanism to control which repositories are advertised to clients via the export-ok file. When the --export-all flag is used, the daemon ignores the absence of this file and publishes all repositories located under the served path.

This creates a scenario where any new repository initialized within the daemon's root directory becomes automatically reachable by any client capable of connecting to the server, without requiring an explicit opt-in for each new project.

Given that Git relies on the hosting environment or filesystem permissions for strict access control, there is uncertainty regarding how to enforce a "private by default" constraint when --export-all is required for existing workflows but new repositories must remain hidden.

• Is there a configuration to override --export-all for specific sub-directories?
• Can the daemon be configured to require export-ok only for newly created repositories while maintaining global visibility for legacy ones?