vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2417): allow gateway host in forgejo webhook ssrf list so config-pr webhook delivers

Browse source
This commit is contained in:
damocles 2026-07-14 20:07:27 +02:00
commit cada704856
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/hive-forge/default.nix
View file

@ -418,6 +418,15 @@ in
# disallowed hosts"). Allow loopback + RFC-1918 sources # disallowed hosts"). Allow loopback + RFC-1918 sources
# so an in-hive mirror of the hyperhive repo works. # so an in-hive mirror of the hyperhive repo works.
migrations.ALLOW_LOCALNETWORKS = true; migrations.ALLOW_LOCALNETWORKS = true;
# Webhook deliveries target the gateway
# (`https://<hyperhive domain>/webhook/*`), which resolves to a
# private (RFC-1918) gateway IP. Forgejo's webhook SSRF guard
# denies private hosts by default, so the config-PR + knowledge
# webhooks never actually deliver — only the 5-min poll fallback
# catches config PRs. Allow the gateway host explicitly; scoping
# to the single hostname keeps the SSRF surface tighter than the
# broad `private` builtin.
webhook.ALLOWED_HOST_LIST = hyperhiveDomain;
log.LEVEL = "Warn"; log.LEVEL = "Warn";
ui = { ui = {
DEFAULT_THEME = "catppuccin-vibec0re"; DEFAULT_THEME = "catppuccin-vibec0re";