vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#3255): expose the controller's webhook endpoint through the swarm vhost

Browse source 
A forge webhook is a machine POST carrying an HMAC and no session cookie,
so it cannot pass the authelia auth-request subrequest every other location
on this vhost uses. This location deliberately omits it; the HMAC check in
the controller is what guards the path.

Scoped to /webhook/forge/ rather than /webhook/ so a future endpoint under
the same prefix does not inherit the bypass.
This commit is contained in:
atlas 2026-08-18 00:26:56 +02:00 • committed by mara
commit a8bc084262
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/host-modules/swarm-ui.nix
View file

@ -188,6 +188,27 @@ in
proxyPass = "http://unix:${controllerCfg.socketPath}:";
extraConfig = swarmAuthRequest;
};
# ⚠️ THE ONE LOCATION ON THIS VHOST WITH NO `swarmAuthRequest`,
# and that is deliberate rather than an omission.
#
# A forge webhook is a machine POST carrying an HMAC signature
# and no session cookie. An authelia auth-request subrequest
# authenticates a *browser session*; there is nothing here for it
# to check, so guarding this location would not make it safer, it
# would make it permanently unreachable.
#
# What replaces it: swarm-controller verifies the
# `X-Hub-Signature-256` HMAC over the raw body before looking at
# anything else, and answers 401 on any mismatch. That check is
# the access control for this path — see the `webhook` module.
#
# Scoped to `/webhook/forge/` rather than `/webhook/` so the
# carve-out is exactly as wide as the endpoint that justifies it:
# a future `/webhook/<something-else>` does not inherit the
# bypass by living under a shared prefix.
"/webhook/forge/" = {
proxyPass = "http://unix:${controllerCfg.socketPath}:";
};
# Swagger UI: same "nginx hosts the themed dist straight from
# the store, only /api/openapi.json is dynamic" shape as the
# per-hive gateway's `swaggerUiLocations`.