In hgweb.config, the allow_push parameter applies to all defined repos defined in the [paths] section. Is there a way to allow push on one repo but not in another, or would I need to actually create completely separate configurations (and corresponding web apps) per repo then? (In case it matters, it's on Windows with hgweb hosted in IIS).
You can define individual push rules per repo in repo\.hg\hgrc file like so:
[web]
allow_push = *
to allow push to everyone or
[web]
allow_push = John
to allow push to John only
If you can't find the hgrc file in repo\.hg\ directory, just create it.