This is only one setup - it can be tweaked in many ways, and is as

specific as it is only in the interests of brevity.

You, and all users of your Hg repository, will need SSH public key

authentication set up, preferably working with ssh-agent so you don't

have to type in your passphrase all the time.  I assume you've done

that in what follows, so if you've done something different you'll

need to change it appropriately.

Create a user called "hg" on the machine where the repository will

live.  I used the command

  sudo adduser --system --shell /bin/sh --group --disabled-password \

    --gecos "Mercural repository" hg

You can use whatever you want in place of "myname" and indeed "admin".

The files in ~/hg must be readable by the hg user.  Issue these

commands to become the hg user and set up the repository

You should now have SSH access to this repository and full control,

which you can test like so:

These attempts to push and pull should report no new changes but

otherwise work.

You can now add other users by putting their keys in an appropriate

subdirectory of the "keys" directory, and control their access by

editing hg-ssh-access.conf.  Changes will take effect as soon as you

push them to the remote ssh server.

Each line of hg-ssh-access.conf has the following syntax:

The "rule" is either "init", "allow", or "deny".  "keypattern" is a

glob pattern matched against the name of the key used - for example,

in our initial setup "admin/myname" matches "admin/*".

"repositorypattern" is a pattern matched againt the repository name -

so "hgadmin" matches "*".  Only boring characters are allowed in

patterns and key and repository names - see the source for details.

Blank lines and lines that start with "#" are ignored.