fix(forgejo): allow webhook delivery to api.riotpiao.com

GITEA__WEBHOOK__ALLOWED_HOST_LIST=external,api.riotpiao.com api.riotpiao.com resolves to cluster ingress ClusterIP (private range) which is blocked by Forgejo's default SSRF protection. Safe to allowlist as it is our own api-gw.
2026-09-27 22:45:13 +08:00
parent 3914c78bc5
commit 8ed60c8b55
1 changed files with 5 additions and 0 deletions
@@ -166,3 +166,8 @@ deployment:
        secretKeyRef:
          name: forgejo-smtp
          key: password
+    # Allow webhooks to reach api-gw through the cluster ingress (resolves to
+    # internal ClusterIP 10.101.x.x which is blocked by default ALLOWED_HOST_LIST).
+    # api.riotpiao.com is our own gateway — safe to allowlist.
+    - name: GITEA__WEBHOOK__ALLOWED_HOST_LIST
+      value: "external,api.riotpiao.com"