vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-forge: cut the webhook allow-list comment to what is not obvious

Browse source 
27 lines to 11. What went: the measured deny line (it is in the PR and the
commit that made the change), the "one value, two readers" argument for reading
the option the target URL is built from, and a note about `unique`.

What stayed is the part nobody can re-derive from the code: `external` must not
be dropped, both hyperhive hosts are private addresses the builtin denies, and
the entry is deliberately not gated on the per-host `deploy.swarm-ui.enable`
because a spread deployment has the forge and the swarm host on different
machines.
This commit is contained in:
atlas 2026-08-31 18:31:47 +02:00
commit dbda6fbde1
1 changed files with 11 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

38
nix/host-modules/hive-forge/default.nix
View file

@ -807,34 +807,18 @@ in
# forge.darkest.space, etc.) were failing every sync # forge.darkest.space, etc.) were failing every sync
# attempt without this. # attempt without this.
migrations.ALLOWED_DOMAINS = "*"; migrations.ALLOWED_DOMAINS = "*";
# `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list: a # Forgejo's webhook SSRF allow-list, a strict whitelist.
# STRICT whitelist whose `external` builtin allows public unicast # `external` (public unicast only) stays, or user-repo webhooks to
# IPs and denies private/loopback. `external` STAYS so user-repo # github/slack break; both hyperhive hosts are added because their
# webhooks to github/slack keep working; the hyperhive hosts are # webhooks target a private gateway IP `external` denies. The
# added on top, because their webhooks target a private (RFC-1918) # swarm's host was the missing one, and every swarm-controller
# gateway IP `external` alone denies — naming the two hosts is # delivery was refused for it.
# tighter than the broad `private` builtin.
# #
# TWO hosts, not one. The hive's carries the config-PR + knowledge # Not gated on `deploy.swarm-ui.enable`: in a spread deployment the
# hooks; the swarm's carries swarm-controller's, and leaving it # forge and the swarm host are different machines, so that
# off denied every one of those: # per-host flag is false exactly where this entry is needed.
# deny '<swarm host>(10.42.0.1:443)' — webhook can only call # `swarm.ui.domain` is the option the controller builds its public
# allowed HTTP servers # URL from; it is slated to collapse into `swarm.domain`.
#
# Read from `swarm.ui.domain` because that is the option
# `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
# from. One value, two readers — an allow-list entry and the
# target it must match are two spellings of one address
# otherwise, and the failure is a delivery refused for a host
# nobody typed wrong.
#
# Not gated on `deploy.swarm-ui.enable`, even though that is what
# makes the controller register the hooks: in a spread deployment
# the forge and the UI are different hosts, so that per-host flag
# is false exactly where this entry is needed.
#
# `unique` because an all-local swarm legitimately serves both
# from one name.
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," ( webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
lib.unique ( lib.unique (
[ [