From cada70485638e72c03ab67f5699f342dfd0782cf Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Tue, 14 Jul 2026 20:07:27 +0200
Subject: [PATCH] fix(#2417): allow gateway host in forgejo webhook ssrf list
 so config-pr webhook delivers

---
 nix/host-modules/hive-forge/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index f79b0367..12f96e3b 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -418,6 +418,15 @@ in
               # disallowed hosts"). Allow loopback + RFC-1918 sources
               # so an in-hive mirror of the hyperhive repo works.
               migrations.ALLOW_LOCALNETWORKS = true;
+              # Webhook deliveries target the gateway
+              # (`https://<hyperhive domain>/webhook/*`), which resolves to a
+              # private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard
+              # denies private hosts by default, so the config-PR + knowledge
+              # webhooks never actually deliver — only the 5-min poll fallback
+              # catches config PRs. Allow the gateway host explicitly; scoping
+              # to the single hostname keeps the SSRF surface tighter than the
+              # broad `private` builtin.
+              webhook.ALLOWED_HOST_LIST = hyperhiveDomain;
               log.LEVEL = "Warn";
               ui = {
                 DEFAULT_THEME = "catppuccin-vibec0re";