From 60e4ea8bb8ec1345f968e0945ce765ea4c620817 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Tue, 14 Jul 2026 20:19:49 +0200
Subject: [PATCH] fix(#2417): keep 'external' in webhook allow-list so public
 webhooks still deliver

---
 nix/host-modules/hive-forge/default.nix | 42 +++++++++++++++----------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 6c7b9536..97194f80 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -205,12 +205,15 @@ in
       ];
       description = ''
         Extra hosts to add to forgejo's webhook SSRF allow-list
-        (`[webhook] ALLOWED_HOST_LIST`). The hive gateway host
-        (`services.hyperhive.domain`) is ALWAYS included — the config-PR
-        and knowledge webhooks target it, and it resolves to a private
-        gateway IP that forgejo's default guard would otherwise deny.
-        Add entries here to additionally allow webhooks from project
-        repos to other hosts (a user's own CI, external services, etc.).
+        (`[webhook] ALLOWED_HOST_LIST`, a strict whitelist). The list
+        always contains the `external` builtin (forgejo's default — all
+        public hosts, so webhooks to github/slack/etc. from user repos
+        keep working) plus the hive gateway host
+        (`services.hyperhive.domain`), which the config-PR and knowledge
+        webhooks target and which resolves to a private gateway IP that
+        `external` alone would deny. Set this to additionally allow
+        webhooks to other hosts (a user's own CI, internal services,
+        etc.).
 
         Entries are forgejo hostmatcher patterns: hostnames, globs,
         IPs/CIDRs, or the builtins `loopback` / `private` / `external`
@@ -440,17 +443,24 @@ in
               # disallowed hosts"). Allow loopback + RFC-1918 sources
               # so an in-hive mirror of the hyperhive repo works.
               migrations.ALLOW_LOCALNETWORKS = true;
-              # Webhook deliveries target the gateway
-              # (`https://<hyperhive domain>/webhook/*`), which resolves to a
-              # private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard
-              # denies private hosts by default, so the config-PR + knowledge
-              # webhooks never actually deliver — only the 5-min poll fallback
-              # catches config PRs. The gateway host is always allowed (scoping
-              # to that one hostname keeps the SSRF surface tighter than the
-              # broad `private` builtin); operators extend the list via
-              # `forge.webhookAllowedHosts` for webhooks on their own repos.
+              # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list, and
+              # it's a STRICT whitelist (only listed hosts deliver). Its
+              # default is the `external` builtin: all public unicast IPs are
+              # allowed, private/loopback denied. We must KEEP `external` so
+              # user-repo webhooks to public hosts (github, slack, …) keep
+              # working, and ADD the hive gateway host on top: the config-PR +
+              # knowledge webhooks target `https://<hyperhive domain>/webhook/*`,
+              # which resolves to a private (RFC-1918) gateway IP that
+              # `external` alone would deny (so they'd only ever be caught by
+              # the 5-min poll fallback). Naming the single gateway host is
+              # tighter than the broad `private` builtin. Operators append more
+              # hosts via `forge.webhookAllowedHosts`.
               webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
-                [ hyperhiveDomain ] ++ cfg.webhookAllowedHosts
+                [
+                  "external"
+                  hyperhiveDomain
+                ]
+                ++ cfg.webhookAllowedHosts
               );
               log.LEVEL = "Warn";
               ui = {