vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#2417): make webhook allow-list additive via forge.webhookAllowedHosts option

Browse source
This commit is contained in:
damocles 2026-07-14 20:16:12 +02:00
commit 00c9a15ae6
1 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/host-modules/hive-forge/default.nix
View file

@ -196,6 +196,28 @@ in
''; '';
}; };
webhookAllowedHosts = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [
"ci.example.com"
"hooks.example.org"
];
description = ''
Extra hosts to add to forgejo's webhook SSRF allow-list
(`[webhook] ALLOWED_HOST_LIST`). The hive gateway host
(`services.hyperhive.domain`) is ALWAYS included — the config-PR
and knowledge webhooks target it, and it resolves to a private
gateway IP that forgejo's default guard would otherwise deny.
Add entries here to additionally allow webhooks from project
repos to other hosts (a user's own CI, external services, etc.).
Entries are forgejo hostmatcher patterns: hostnames, globs,
IPs/CIDRs, or the builtins `loopback` / `private` / `external`
/ `*`.
'';
};
openFirewall = lib.mkOption { openFirewall = lib.mkOption {
type = lib.types.bool; type = lib.types.bool;
default = false; default = false;
@ -423,10 +445,13 @@ in
# private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard # private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard
# denies private hosts by default, so the config-PR + knowledge # denies private hosts by default, so the config-PR + knowledge
# webhooks never actually deliver — only the 5-min poll fallback # webhooks never actually deliver — only the 5-min poll fallback
# catches config PRs. Allow the gateway host explicitly; scoping # catches config PRs. The gateway host is always allowed (scoping
# to the single hostname keeps the SSRF surface tighter than the # to that one hostname keeps the SSRF surface tighter than the
# broad `private` builtin. # broad `private` builtin); operators extend the list via
webhook.ALLOWED_HOST_LIST = hyperhiveDomain; # `forge.webhookAllowedHosts` for webhooks on their own repos.
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
[ hyperhiveDomain ] ++ cfg.webhookAllowedHosts
);
log.LEVEL = "Warn"; log.LEVEL = "Warn";
ui = { ui = {
DEFAULT_THEME = "catppuccin-vibec0re"; DEFAULT_THEME = "catppuccin-vibec0re";