We host most of our Mercurial repositories externally - this is primarily the infrastructure we had prior to adopting Phabricator. We have a few repositories hosted by Diffusion, however our server runs 2.6.2 which does not utilize the bundle2 protocol.

Hopefully at some point we'll figure out a nice way of handling bundle2. I haven't had much time to dive into figuring out what all would be involved. See T9548.

If I host externally, I basically lose the access control and herald rules, right?

I was looking through the Diffusion source after I hit this problem the other day, and trying to figure out why Diffusion needs to unpack the wire protocol and how much detail it needs to parse out.. My (rather uninformed) impression was that Diffusion basically needs to find enough information to know whether the interaction with the repository is read only or if it modifies the repository in some way.. Is that about the size of it?

Tried running 2.6.2 on the server side, and that indeed does fix the bundle2 issue, but creates more issues when trying to push from a 3.7.3 hg client.. :-(