Gitolite config won't deny permissions

Question

I'm having a config file like this:

@all = @group1 @group2 @group3
@group1 = user1 user2 user3
@group2 = user4 user5 user6
@group3 = user7 user8 user9

repo production_repo
    RW+           = server_key
    R             = @all

    R group_branch1 = @group1
    R group_branch1_user1 = @group1
    RW group_branch1_user1 = user1

Problem is now that also i give just read rights to all users, everyone can write on the master branch. When i add a - master = @all as first line the result is the same.

How can i make master read-only to the @all group and give right permissions just on the users own featurebranch?

Thanks in advance.

Answer 1

Following "Gitolite permissions on branches" and the gitolite rules, you could try:
(only for gitolite g3, unfortunately, which means a g2 would need to migrate)

repo production_repo

    RW+           = server_key
    R     master  = @all
    -     master  = @all

    R group_branch1 = @group1
    R group_branch1_user1 = @group1
    RW group_branch1_user1 = user1