darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

gitea: allow tailnet webhook targets

Browse Source 
Webhook delivery to the hermes relay was refused outright:

  Post "http://mars.orbit.sol:8645/gitea/gitea-pr-comments":
  dial tcp 100.64.0.6:8645: webhook can only call allowed HTTP servers
  (check your security.ALLOWED_HOST_LIST setting),
  deny 'mars.orbit.sol(100.64.0.6:8645)'

ALLOWED_HOST_LIST defaults to `external`, documented as "a valid non-private
unicast IP". Tailscale addresses come from 100.64.0.0/10 — RFC 6598
carrier-grade NAT space — which is not RFC1918 private but does not satisfy
gitea's notion of external either, so every tailnet target is denied by
default. Nothing about the relay or the URL was wrong; the request never left
jupiter.

Sets the tailnet CIDR explicitly and keeps `external`, so a future webhook to
a public service still works without another edit here.

Goes in [security], not [webhook]: the webhook-section key is deprecated in
favour of this one and now merely falls back to it, and [security] is the
name the delivery error itself reports.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa
This commit is contained in:
darman
2026-08-23 07:35:03 +02:00
co-authored by Claude Opus 5
parent e14571d029
commit ee3051f6e4
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/dev/gitea.nix
+17
View File
@@ -77,6 +77,23 @@ in
service = { service = {
DISABLE_REGISTRATION = true; DISABLE_REGISTRATION = true;
}; };
security = {
# Gitea refuses to deliver a webhook to any host outside this list,
# which defaults to `external` — "a valid non-private unicast IP".
# Tailscale addresses are 100.64.0.0/10 (RFC 6598 carrier-grade NAT),
# which is neither RFC1918 private nor, as far as gitea's matcher is
# concerned, external — so the hermes relay on mars was refused with
# deny 'mars.orbit.sol(100.64.0.6:8645)'
# even though nothing here is private in the RFC1918 sense. Adding
# the tailnet CIDR is what makes tailnet-internal webhook targets
# deliverable at all; `external` is kept so a future webhook to a
# public service (discord, slack) still works without another edit.
#
# This lives in [security], not [webhook]: the webhook-section key is
# deprecated and now just falls back to this one, which is the name
# the delivery error itself reports.
ALLOWED_HOST_LIST = "external,100.64.0.0/10";
};
actions = { actions = {
ENABLED = true; ENABLED = true;
}; };