Vestaweb was inspired by CVSweb (and lifts some code for the colorized diffs).
The web server it runs on needs to be a client of the repository you're interested in. Other then that, it needs no special access. There are a few configuration variables at the top of the script that you should adjust for your site.
I think the best way to get an idea of how it works is for you to try it. Or you can look at some screen shots. Notice the scrollbar at the bottom of the diff view. The two versions are shown side-by-side. Everything else in vestaweb works in a much more reasonably sized window. I've also done my best to make it browser agnostic. If you run into any browser compatibility problems, please let me know.
Vestaweb is relased under the terms of the GNU General Public License. You can also replicate it from /vesta/vestasys.org/vesta/extras/vestaweb in the public vesta repository.
Using a MIME handler that's called from the browser, it can even check packages in and out. Before you enable this feature, you probably want to protect vestaweb with some sort of authentication. In fact, you need to use some system that sets $REMOTE_USER. If the checkout features are disabled, there's no need to provide authentication - unless you want to protect your source, that is.
If you have any problems, questions, comments, suggestions, patches, or just general chatter about vestaweb, you can post to the vesta-users mailing list, or you can mail me directly at scott at scooter dot cx.