vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

Compare commits

base: vinzenz:ff7897f9bc7a3a56ec8591a24bcbe51baa76e3ce
Branches Tags
vinzenz:main
...
compare: vinzenz:dbda6fbde15c3235d0680c77700d47450572533d
Branches Tags
vinzenz:main
Author SHA1 Message Date
atlas
dbda6fbde1 hive-forge: cut the webhook allow-list comment to what is not obvious 
27 lines to 11. What went: the measured deny line (it is in the PR and the
commit that made the change), the "one value, two readers" argument for reading
the option the target URL is built from, and a note about `unique`.

What stayed is the part nobody can re-derive from the code: `external` must not
be dropped, both hyperhive hosts are private addresses the builtin denies, and
the entry is deliberately not gated on the per-host `deploy.swarm-ui.enable`
because a spread deployment has the forge and the swarm host on different
machines.
 2026-08-31 18:31:47 +02:00
atlas
a44107c617 hive-forge: inline the webhook-host binding, used once 
Her review: don't declare a `let` for a single use. The comment that justified
the binding moves to the use site and drops the claim it was carrying — that
`swarm.ui.domain` and `swarm.domain` can diverge — keeping only the part that
holds either way: this reads the same option swarm-controller builds its public
URL from, so the allow-list entry and the target it must match are one value
rather than two spellings.
 2026-08-31 18:26:34 +02:00
atlas
b9919164e4 hive-forge: read the webhook host from the option the target is built from 
`swarm.domain` is not the value swarm-controller addresses this hive with —
`swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL` from
`swarm.ui.domain`, which merely defaults to it and is documented as
overridable. Allowing the one and being delivered the other would work until
someone takes that option up, then fail as a refused delivery with nothing
naming the cause.

Also states why the entry is NOT gated on `deploy.swarm-ui.enable`, which is
what makes the controller register the hooks at all: in a spread deployment the
forge and the swarm UI are different hosts, so that per-host flag is false
exactly where the allow-list entry is needed.

The comment-block lint caught the prose at 35 lines; trimmed to the parts a
reader cannot re-derive.
 2026-08-31 18:19:39 +02:00
atlas
584c99ce13 hive-forge: allow the swarm domain through forgejo's webhook SSRF list 
`webhook.ALLOWED_HOST_LIST` named `external` plus the HIVE domain. The
swarm-controller's webhooks target the SWARM domain, which is a different host
on the same private gateway IP — so `external` denied it and the hive entry did
not cover it. Every swarm-controller delivery has been failing there.

Found from the sender's log, which names the host and the rule it broke:

  deny 'constellation.darkest.space(10.42.0.1:443)'
  webhook can only call allowed HTTP servers (check your
  webhook.ALLOWED_HOST_LIST setting)

This is the layer under the DNS fix: resolution now succeeds and reaches
10.42.0.1:443, and forgejo refuses to dial it. The two failures look identical
from the receiving end — no delivery, no log line — which is why reading the
sender was what separated them.

`optional` because a hive with no swarm has no such domain; `unique` because an
all-local deployment can legitimately set both to the same string.
 2026-08-31 18:15:49 +02:00
1 changed files with 21 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/host-modules/hive-forge/default.nix
View file

@ -807,18 +807,27 @@ in
# forge.darkest.space, etc.) were failing every sync
# attempt without this.
migrations.ALLOWED_DOMAINS = "*";
# `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list, and
# it's a STRICT whitelist (only listed hosts deliver). Its
# default is the `external` builtin: all public unicast IPs are
# allowed, private/loopback denied. We must KEEP `external` so
# user-repo webhooks to public hosts (github, slack, …) keep
# working, and ADD the hive gateway host on top: the config-PR +
# knowledge webhooks target `https://<hyperhive domain>/webhook/*`,
# which resolves to a private (RFC-1918) gateway IP that
# `external` alone would deny (so they'd only ever be caught by
# the 5-min poll fallback). Naming the single gateway host is
# tighter than the broad `private` builtin.
webhook.ALLOWED_HOST_LIST = "external,${hyperhiveDomain}";
# Forgejo's webhook SSRF allow-list, a strict whitelist.
# `external` (public unicast only) stays, or user-repo webhooks to
# github/slack break; both hyperhive hosts are added because their
# webhooks target a private gateway IP `external` denies. The
# swarm's host was the missing one, and every swarm-controller
# delivery was refused for it.
#
# Not gated on `deploy.swarm-ui.enable`: in a spread deployment the
# forge and the swarm host are different machines, so that
# per-host flag is false exactly where this entry is needed.
# `swarm.ui.domain` is the option the controller builds its public
# URL from; it is slated to collapse into `swarm.domain`.
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
lib.unique (
[
"external"
hyperhiveDomain
]
++ lib.optional (swarmDomain != null) config.services.hyperhive.swarm.ui.domain
)
);
log.LEVEL = "Warn";
# Pinned explicitly rather than left to upstream's default
# (currently `bleve`, a separate full-text index Forgejo