Webhook delivery to the hermes relay was refused outright:
Post "http://mars.orbit.sol:8645/gitea/gitea-pr-comments":
dial tcp 100.64.0.6:8645: webhook can only call allowed HTTP servers
(check your security.ALLOWED_HOST_LIST setting),
deny 'mars.orbit.sol(100.64.0.6:8645)'
ALLOWED_HOST_LIST defaults to `external`, documented as "a valid non-private
unicast IP". Tailscale addresses come from 100.64.0.0/10 — RFC 6598
carrier-grade NAT space — which is not RFC1918 private but does not satisfy
gitea's notion of external either, so every tailnet target is denied by
default. Nothing about the relay or the URL was wrong; the request never left
jupiter.
Sets the tailnet CIDR explicitly and keeps `external`, so a future webhook to
a public service still works without another edit here.
Goes in [security], not [webhook]: the webhook-section key is deprecated in
favour of this one and now merely falls back to it, and [security] is the
name the delivery error itself reports.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa
darmanandClaude Opus 5
ee3051f6e4