Answer
No. git daemon --export-all disables the export-ok check for the entire served tree. There is no configuration flag to override --export-all for specific sub-directories, and the daemon cannot be made to require export-ok only for newly created repositories while keeping global visibility for legacy ones under the same base path.
Confirmed facts
--export-all makes the daemon advertise every repository found under the served path, regardless of the presence of export-ok.- The export-ok check is a per-repository gate. When
--export-all is set, that gate is disabled globally for the daemon instance.
- Git daemon has no per-directory or per-repo policy toggle. Visibility is controlled by the served base path and by the presence of
export-ok when the flag is not used.
Likely explanation for the constraint
The daemon decides exportability at startup from the command line. With --export-all the code path that tests for export-ok is skipped for all repositories. There is no built-in routing or exclusion list to re-enable the test for a subtree.
Practical steps for private-by-default with legacy visibility
- Separate the repository trees.
- Legacy repos that must stay visible:
/srv/git/legacy
- New repos that must stay hidden by default:
/srv/git/new
- Run two daemon instances with different policies.
git daemon --export-all --base-path=/srv/git/legacy --listen=0.0.0.0 --port=9418
git daemon --base-path=/srv/git/new --listen=0.0.0.0 --port=9419
The second instance has no --export-all, so only repositories containing an export-ok file are advertised.
- Route clients appropriately. Use a reverse proxy or documentation to point legacy clients to port 9418 and new projects to port 9419, or keep the new tree completely off the public daemon.
- For any repo you want to publish in the new tree, create the opt-in file:
touch /srv/git/new/project.git/export-ok
Verification
- Confirm the daemon command line shows
--export-all for the legacy instance and not for the new instance.
- Run
git ls-remote git://host:9418/legacy/repo.git and git ls-remote git://host:9419/new/repo.git to verify advertising matches expectations.
Caution: changing the served directory or policy requires a daemon restart. File system permissions still control read access; git daemon provides advertising control only, not authentication.
One diagnostic detail that changes the recommendation: can new repositories be moved to a separate base path from legacy repositories? If they must stay under the same physical tree, the only supported options are to drop --export-all globally and manage export-ok for all repos, or to use an external wrapper/proxy that filters advertisements.
git