Paths & targets

Which repositories the machines read, which cgit endpoints they use, and the small tail of requests for paths that do not exist, such as guessed credential files.

repositories touched

distinct paths

repo-less paths

no repository in the path

not found

404s

page chrome

stylesheet, script, logo, favicon

repository files

.png/.js/.css inside repos

The chrome tile shows what this log carries, not who drew a page. Every path here begins at /git. cgit serves its own stylesheet and script from /cgit.js and /static/*, outside that prefix, so a caller that renders a page writes nothing here. The chrome-shaped rows this file does hold are /git/cgit.css and /git/cgit.png, requests in all. Every other asset-shaped path belongs to a repository and arrives through cgit's plain, tree, and diff views. Those requests do arrive: the server's unfiltered access log carries them.

Where the demand goes

The largest repositories by request volume, with served and aborted counts.

Which cgit endpoint

Requests per day by cgit endpoint. A reader opens a tree. A mirror requests every endpoint of every path.

/diff, /plain, /log, /tree, and /commit move together, in the proportions of a sweep rather than browsing.

The loud tail

Paths outside the cgit routes. These requests guess repository names and credential files. The volume is small and the intent is clear.

These requests look like an attack and mostly are not one. The defence budget goes to the fleet that reads legitimate cgit paths, not to a handful of /.env guesses.