leora/gitea-selfhost
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
13 Commits 3 Branches 0 Tags
Commit Graph

5 Commits

Author SHA1 Message Date
leora
dcfeb12c68 Re-review fixes: EGRESS_MODE=lax on Gitea 28, basic-auth prod gate, pinned sha256, kit-owned down 
- app.ini.template: [security] EGRESS_MODE = lax (ALLOWED_HOST_LIST=external is invalid on 28.1.0)
- README: egress rows for 28 vs 1.23; rollout gate while password basic auth is on (edge 429 on
  Authorization: Basic to /api/v1/ and git HTTP, or tokens first)
- kit.sh: pinned sha256 per arch for 28.1.0; down stops only its own pid or the unit it installed
- e2e: package upload must be 404; 'denied by egress' polled from the Gitea log; 4 MB attachment
  cap; Actions off; fail on [E] / 'invalid entry'; listener cleaned up in trap
 2026-10-15 20:57:10 +08:00
leora
c8d58daabf Review fixes: ALLOWED_HOST_LIST explicit, no password basic auth, bounded storage, rollout order, adversarial e2e 
- drop EGRESS_MODE; [security] ALLOWED_HOST_LIST = external (Gitea 28+; [webhook] on 1.23)
- ENABLE_BASIC_AUTHENTICATION = false (tokens still work); e2e clones with the token
- packages and Actions off; attachments and web uploads capped at 4 MB / 3 files
- README: rollout order (edge rate limit first, verify, then captcha off; rollback),
  storage notes (proxy body cap, disk alert, user purge), REGISTER_MANUAL_CONFIRM emergency
  switch, EMAIL_DOMAIN_ALLOWLIST/BLOCKLIST, known gaps (email enumeration, /join reserved names)
- e2e: password basic auth refused (API + git push), token works, 11th repo / org / package
  refused, webhook to 127.0.0.1 not delivered, sign-up burst marked PENDING (edge rule)
 2026-10-15 20:40:56 +08:00
leora
6df3136409 Agent-native sign-up: drop the captcha, document non-captcha abuse controls 2026-10-15 20:36:47 +08:00
leora
4289b8ac35 Follow-up: raise paging to 100, case-insensitive .profile, row sub-template, README notes 
Earlier commit 7a16ae0 'x' added the first README section for this change; it is kept
rather than force-pushing the open PR branch.
 2026-10-15 20:27:07 +08:00
leora
67c23e9561 Add self-host kit: compose + binary/systemd, app.ini template, kit.sh, e2e test, MIT license 2026-10-08 22:08:55 +08:00