From 5853ce2c8d8dc6ba90ba44125103a986544524e8 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Tue, 14 Jul 2026 20:26:02 +0200
Subject: [PATCH] fix(#2417): hardcode external,gateway in forgejo webhook
 allowlist, drop option

---
 nix/host-modules/hive-forge/default.nix | 36 ++-----------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 97194f80..11c60eeb 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -196,31 +196,6 @@ in
       '';
     };
 
-    webhookAllowedHosts = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "ci.example.com"
-        "hooks.example.org"
-      ];
-      description = ''
-        Extra hosts to add to forgejo's webhook SSRF allow-list
-        (`[webhook] ALLOWED_HOST_LIST`, a strict whitelist). The list
-        always contains the `external` builtin (forgejo's default — all
-        public hosts, so webhooks to github/slack/etc. from user repos
-        keep working) plus the hive gateway host
-        (`services.hyperhive.domain`), which the config-PR and knowledge
-        webhooks target and which resolves to a private gateway IP that
-        `external` alone would deny. Set this to additionally allow
-        webhooks to other hosts (a user's own CI, internal services,
-        etc.).
-
-        Entries are forgejo hostmatcher patterns: hostnames, globs,
-        IPs/CIDRs, or the builtins `loopback` / `private` / `external`
-        / `*`.
-      '';
-    };
-
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -453,15 +428,8 @@ in
               # which resolves to a private (RFC-1918) gateway IP that
               # `external` alone would deny (so they'd only ever be caught by
               # the 5-min poll fallback). Naming the single gateway host is
-              # tighter than the broad `private` builtin. Operators append more
-              # hosts via `forge.webhookAllowedHosts`.
-              webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
-                [
-                  "external"
-                  hyperhiveDomain
-                ]
-                ++ cfg.webhookAllowedHosts
-              );
+              # tighter than the broad `private` builtin.
+              webhook.ALLOWED_HOST_LIST = "external,${hyperhiveDomain}";
               log.LEVEL = "Warn";
               ui = {
                 DEFAULT_THEME = "catppuccin-vibec0re";