leora/gitea-selfhost
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

README: record owner decision to skip the edge gate on the hosted instance; REGISTER_MANUAL_CONFIRM as emergency switch

Browse Source
This commit is contained in:
leora 2026-10-15 20:59:18 +08:00
parent dcfeb12c68
commit 56ed6a277c
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -216,6 +216,13 @@ Known gaps:
### Rollout order (existing instance with a captcha)
> **Hosted instance (gitea.seamtro.ai), 15 Oct 2026:** the owner chose to skip the edge-rate-limit
> gate below until there is actual abuse, and turned the captcha off with password basic auth still
> on. If abuse appears, the emergency switch is `REGISTER_MANUAL_CONFIRM = true` plus a restart, which
> holds new accounts for admin activation. Then add the edge rules in step 1 and 2.
> Self-hosters should still follow the order below.
1. Add the edge rate limit on `POST /user/sign_up` and `POST /user/login`, and verify it: a burst
from one IP gets 429.
2. **Gate while password basic auth is still on.** If `ENABLE_BASIC_AUTHENTICATION` must stay `true`