From 8ed60c8b5519ee3cae1b8a14b7e30c7cd0f282d3 Mon Sep 17 00:00:00 2001 From: rock Date: Sun, 27 Sep 2026 22:45:13 +0800 Subject: [PATCH] fix(forgejo): allow webhook delivery to api.riotpiao.com GITEA__WEBHOOK__ALLOWED_HOST_LIST=external,api.riotpiao.com api.riotpiao.com resolves to cluster ingress ClusterIP (private range) which is blocked by Forgejo's default SSRF protection. Safe to allowlist as it is our own api-gw. --- k8s/bootstrap/phase3-forgejo/forgejo-values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml index 3d3519b..fefb458 100644 --- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml +++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml @@ -166,3 +166,8 @@ deployment: secretKeyRef: name: forgejo-smtp key: password + # Allow webhooks to reach api-gw through the cluster ingress (resolves to + # internal ClusterIP 10.101.x.x which is blocked by default ALLOWED_HOST_LIST). + # api.riotpiao.com is our own gateway — safe to allowlist. + - name: GITEA__WEBHOOK__ALLOWED_HOST_LIST + value: "external,api.riotpiao.com"