app.rb

require 'gollum/app'
require 'digest/sha1'

class App < Precious::App
  User = Struct.new(:name, :email, :password_hash, :can_write)

  before { authenticate! }
  before /^\/(edit|create|delete|livepreview|revert)/ do authorize_write! ; end

  helpers do
    def authenticate!
      @_auth ||=  Rack::Auth::Basic::Request.new(request.env)
      if @_auth.provided?
      end
      if @_auth.provided? && @_auth.basic? && @_auth.credentials &&
        @user = detected_user(@_auth.credentials)
        return @user
      else
        response['WWW-Authenticate'] = %(Basic realm="Gollum Wiki")
        throw(:halt, [401, "Not authorized\n"])
      end
    end

    def authorize_write!
      throw(:halt, [403, "Forbidden\n"]) unless @user.can_write
    end

    def users
      @_users ||= settings.authorized_users.map {|u| User.new(*u) }
    end

    def detected_user(credentials)
      users.detect do |u|
        [u.email, u.password_hash] ==
        [credentials[0], Digest::SHA1.hexdigest(credentials[1])]
      end
    end
  end

  def commit_message
    {
      :message => params[:message],
      :name => @user.name,
      :email => @user.email
    }
  end
end

config.ru

__DIR__ = File.expand_path(File.dirname(__FILE__))
$: << __DIR__
require 'rubygems'
require 'yaml'
require 'app'
App.set(:gollum_path, __DIR__ + "/wikidata")
App.set(:authorized_users, YAML.load_file(File.expand_path('users.yml', __DIR__)))
App.set(:wiki_options, {})
run App

serve.sh

#!/bin/bash
# kill any running gollums
# NOTE xargs kill -9 will complain if no rackup found
ps -ef | grep rackup | grep -v grep | awk '{print $2}' | xargs -I{} kill -9 {}
# start gollum as a background process
# you can pipe output to /dev/null instead, if you don't want a log
nohup rackup -p 4567 config.ru > gollum.log &

users.yml

---
- - User Name
  - user@example.com
  - e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 # secret
  - true
- - Another User
  - another@example.com
  - b4341ce88a4943631b9573d9e0e5b28991de945d # p455w0rd
  - true