From dbda6fbde15c3235d0680c77700d47450572533d Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 31 Aug 2026 18:31:47 +0200 Subject: [PATCH] hive-forge: cut the webhook allow-list comment to what is not obvious 27 lines to 11. What went: the measured deny line (it is in the PR and the commit that made the change), the "one value, two readers" argument for reading the option the target URL is built from, and a note about `unique`. What stayed is the part nobody can re-derive from the code: `external` must not be dropped, both hyperhive hosts are private addresses the builtin denies, and the entry is deliberately not gated on the per-host `deploy.swarm-ui.enable` because a spread deployment has the forge and the swarm host on different machines. --- nix/host-modules/hive-forge/default.nix | 38 +++++++------------------ 1 file changed, 11 insertions(+), 27 deletions(-) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index 16909551..6863ce03 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -807,34 +807,18 @@ in # forge.darkest.space, etc.) were failing every sync # attempt without this. migrations.ALLOWED_DOMAINS = "*"; - # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list: a - # STRICT whitelist whose `external` builtin allows public unicast - # IPs and denies private/loopback. `external` STAYS so user-repo - # webhooks to github/slack keep working; the hyperhive hosts are - # added on top, because their webhooks target a private (RFC-1918) - # gateway IP `external` alone denies — naming the two hosts is - # tighter than the broad `private` builtin. + # Forgejo's webhook SSRF allow-list, a strict whitelist. + # `external` (public unicast only) stays, or user-repo webhooks to + # github/slack break; both hyperhive hosts are added because their + # webhooks target a private gateway IP `external` denies. The + # swarm's host was the missing one, and every swarm-controller + # delivery was refused for it. # - # TWO hosts, not one. The hive's carries the config-PR + knowledge - # hooks; the swarm's carries swarm-controller's, and leaving it - # off denied every one of those: - # deny '(10.42.0.1:443)' — webhook can only call - # allowed HTTP servers - # - # Read from `swarm.ui.domain` because that is the option - # `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL` - # from. One value, two readers — an allow-list entry and the - # target it must match are two spellings of one address - # otherwise, and the failure is a delivery refused for a host - # nobody typed wrong. - # - # Not gated on `deploy.swarm-ui.enable`, even though that is what - # makes the controller register the hooks: in a spread deployment - # the forge and the UI are different hosts, so that per-host flag - # is false exactly where this entry is needed. - # - # `unique` because an all-local swarm legitimately serves both - # from one name. + # Not gated on `deploy.swarm-ui.enable`: in a spread deployment the + # forge and the swarm host are different machines, so that + # per-host flag is false exactly where this entry is needed. + # `swarm.ui.domain` is the option the controller builds its public + # URL from; it is slated to collapse into `swarm.domain`. webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," ( lib.unique ( [