fix(#2417): keep 'external' in webhook allow-list so public webhooks still deliver

nix/host-modules/hive-forge/default.nix

@@ -205,12 +205,15 @@ in
       ];
       description = ''
         Extra hosts to add to forgejo's webhook SSRF allow-list
-        (`[webhook] ALLOWED_HOST_LIST`). The hive gateway host
+        (`[webhook] ALLOWED_HOST_LIST`, a strict whitelist). The list
-        (`services.hyperhive.domain`) is ALWAYS included — the config-PR
+        always contains the `external` builtin (forgejo's default — all
-        and knowledge webhooks target it, and it resolves to a private
+        public hosts, so webhooks to github/slack/etc. from user repos
-        gateway IP that forgejo's default guard would otherwise deny.
+        keep working) plus the hive gateway host
-        Add entries here to additionally allow webhooks from project
+        (`services.hyperhive.domain`), which the config-PR and knowledge
-        repos to other hosts (a user's own CI, external services, etc.).
+        webhooks target and which resolves to a private gateway IP that
+        `external` alone would deny. Set this to additionally allow
+        webhooks to other hosts (a user's own CI, internal services,
+        etc.).
 
         Entries are forgejo hostmatcher patterns: hostnames, globs,
         IPs/CIDRs, or the builtins `loopback` / `private` / `external`
@@ -440,17 +443,24 @@ in
               # disallowed hosts"). Allow loopback + RFC-1918 sources
               # so an in-hive mirror of the hyperhive repo works.
               migrations.ALLOW_LOCALNETWORKS = true;
-              # Webhook deliveries target the gateway
+              # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list, and
-              # (`https://<hyperhive domain>/webhook/*`), which resolves to a
+              # it's a STRICT whitelist (only listed hosts deliver). Its
-              # private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard
+              # default is the `external` builtin: all public unicast IPs are
-              # denies private hosts by default, so the config-PR + knowledge
+              # allowed, private/loopback denied. We must KEEP `external` so
-              # webhooks never actually deliver — only the 5-min poll fallback
+              # user-repo webhooks to public hosts (github, slack, …) keep
-              # catches config PRs. The gateway host is always allowed (scoping
+              # working, and ADD the hive gateway host on top: the config-PR +
-              # to that one hostname keeps the SSRF surface tighter than the
+              # knowledge webhooks target `https://<hyperhive domain>/webhook/*`,
-              # broad `private` builtin); operators extend the list via
+              # which resolves to a private (RFC-1918) gateway IP that
-              # `forge.webhookAllowedHosts` for webhooks on their own repos.
+              # `external` alone would deny (so they'd only ever be caught by
+              # the 5-min poll fallback). Naming the single gateway host is
+              # tighter than the broad `private` builtin. Operators append more
+              # hosts via `forge.webhookAllowedHosts`.
               webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
-                [ hyperhiveDomain ] ++ cfg.webhookAllowedHosts
+                [
+                  "external"
+                  hyperhiveDomain
+                ]
+                ++ cfg.webhookAllowedHosts
               );
               log.LEVEL = "Warn";
               ui = {