From 900eb1719dd8137a2bbd8ff9fe7e461b25d9c136 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Thu, 3 Sep 2026 01:29:36 +0530 Subject: [PATCH] Allow Gitea webhooks to reach private-LAN hosts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Webhook delivery to jenkins.192.168.1.7.nip.io failed: "webhook can only call allowed HTTP servers (check your security.ALLOWED_HOST_LIST setting)". Gitea's SSRF protection blocks outbound webhook calls to private/internal IPs by default. Set to "*" rather than a narrow allowlist — every host on this homelab is on the same private LAN, so a per-host allowlist would just need updating every time a new service needs webhook access, matching the lightweight security posture already used elsewhere (ArgoCD --insecure, plain HTTP throughout). --- .../k8s-admin-prd-ase1/gitea/custom-values.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml index 7318bb3..6d370af 100644 --- a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml @@ -64,6 +64,17 @@ gitea: DB_TYPE: sqlite3 actions: ENABLED: true + security: + # Gitea's own SSRF protection blocks outbound webhook calls to + # private/internal IPs by default — hit this trying to fire a + # webhook at jenkins.192.168.1.7.nip.io ("webhook can only call + # allowed HTTP servers"). Everything on this homelab lives on a + # private LAN, so a narrow allowlist would just mean editing + # this every time a new *.192.168.1.7.nip.io/*.100.90.248.118.nip.io + # host needs webhook access — matches the lightweight security + # posture already used elsewhere here (ArgoCD --insecure, plain + # HTTP throughout). + ALLOWED_HOST_LIST: "*" admin: username: gitadmin # The running install set this via a plaintext --set-string flag at