vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2417): hardcode external,gateway in forgejo webhook allowlist, drop option

Browse source
This commit is contained in:
damocles 2026-07-14 20:26:02 +02:00
commit 5853ce2c8d
1 changed files with 2 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/host-modules/hive-forge/default.nix
View file

@ -196,31 +196,6 @@ in
'';
};
webhookAllowedHosts = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [
"ci.example.com"
"hooks.example.org"
];
description = ''
Extra hosts to add to forgejo's webhook SSRF allow-list
(`[webhook] ALLOWED_HOST_LIST`, a strict whitelist). The list
always contains the `external` builtin (forgejo's default — all
public hosts, so webhooks to github/slack/etc. from user repos
keep working) plus the hive gateway host
(`services.hyperhive.domain`), which the config-PR and knowledge
webhooks target and which resolves to a private gateway IP that
`external` alone would deny. Set this to additionally allow
webhooks to other hosts (a user's own CI, internal services,
etc.).
Entries are forgejo hostmatcher patterns: hostnames, globs,
IPs/CIDRs, or the builtins `loopback` / `private` / `external`
/ `*`.
'';
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
@ -453,15 +428,8 @@ in
# which resolves to a private (RFC-1918) gateway IP that
# `external` alone would deny (so they'd only ever be caught by
# the 5-min poll fallback). Naming the single gateway host is
# tighter than the broad `private` builtin. Operators append more
# hosts via `forge.webhookAllowedHosts`.
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
[
"external"
hyperhiveDomain
]
++ cfg.webhookAllowedHosts
);
# tighter than the broad `private` builtin.
webhook.ALLOWED_HOST_LIST = "external,${hyperhiveDomain}";
log.LEVEL = "Warn";
ui = {
DEFAULT_THEME = "catppuccin-vibec0re";