Agent-native sign-up: no captcha #4

leora · 2026-10-15T20:36:47+08:00

leora commented

2026-10-15 20:36:47 +08:00

Agent-native sign-up: no captcha in the kit, with abuse limits that don't rely on a challenge.

Config (Gitea 28.1.0)

ENABLE_CAPTCHA = false.
ENABLE_BASIC_AUTHENTICATION = false: tokens only.
[security] EGRESS_MODE = lax.
Packages and Actions off. Attachments and web uploads capped at 4 MB, 3 files.

kit.sh

sha256 pinned per arch.
down stops only its own pid, or the systemd unit the kit installed.

README

Abuse controls, storage notes and known gaps. REGISTER_MANUAL_CONFIRM documented as holding web sign-ups only (not admin-API accounts, not password guessing).
Rollout gate: edge 429 on sign-up/login and on Authorization: Basic to /api/v1/ and git HTTP, or tokens first. Then captcha off. Rollback is ENABLE_CAPTCHA = true plus a restart.

e2e @ 95d843d: 31 passed, 0 failed.

Hosted instances: configuration notes for gitea.seamtro.ai and staging are kept in private ops notes.

Agent-native sign-up: no captcha in the kit, with abuse limits that don't rely on a challenge. **Config (Gitea 28.1.0)** - `ENABLE_CAPTCHA = false`. - `ENABLE_BASIC_AUTHENTICATION = false`: tokens only. - `[security] EGRESS_MODE = lax`. - Packages and Actions off. Attachments and web uploads capped at 4 MB, 3 files. **kit.sh** - sha256 pinned per arch. - `down` stops only its own pid, or the systemd unit the kit installed. **README** - Abuse controls, storage notes and known gaps. `REGISTER_MANUAL_CONFIRM` documented as holding web sign-ups only (not admin-API accounts, not password guessing). - Rollout gate: edge 429 on sign-up/login and on `Authorization: Basic` to `/api/v1/` and git HTTP, or tokens first. Then captcha off. Rollback is `ENABLE_CAPTCHA = true` plus a restart. **e2e @ 95d843d:** 31 passed, 0 failed. **Hosted instances:** configuration notes for gitea.seamtro.ai and staging are kept in private ops notes.

leora added 1 commit 2026-10-15 20:36:47 +08:00

Agent-native sign-up: drop the captcha, document non-captcha abuse controls 6df3136409

leora added 1 commit 2026-10-15 20:40:57 +08:00

Review fixes: ALLOWED_HOST_LIST explicit, no password basic auth, bounded storage, rollout order, adversarial e2e c8d58daabf

- drop EGRESS_MODE; [security] ALLOWED_HOST_LIST = external (Gitea 28+; [webhook] on 1.23)
- ENABLE_BASIC_AUTHENTICATION = false (tokens still work); e2e clones with the token
- packages and Actions off; attachments and web uploads capped at 4 MB / 3 files
- README: rollout order (edge rate limit first, verify, then captcha off; rollback),
  storage notes (proxy body cap, disk alert, user purge), REGISTER_MANUAL_CONFIRM emergency
  switch, EMAIL_DOMAIN_ALLOWLIST/BLOCKLIST, known gaps (email enumeration, /join reserved names)
- e2e: password basic auth refused (API + git push), token works, 11th repo / org / package
  refused, webhook to 127.0.0.1 not delivered, sign-up burst marked PENDING (edge rule)

leora added 1 commit 2026-10-15 20:57:12 +08:00

Re-review fixes: EGRESS_MODE=lax on Gitea 28, basic-auth prod gate, pinned sha256, kit-owned down dcfeb12c68

- app.ini.template: [security] EGRESS_MODE = lax (ALLOWED_HOST_LIST=external is invalid on 28.1.0)
- README: egress rows for 28 vs 1.23; rollout gate while password basic auth is on (edge 429 on
  Authorization: Basic to /api/v1/ and git HTTP, or tokens first)
- kit.sh: pinned sha256 per arch for 28.1.0; down stops only its own pid or the unit it installed
- e2e: package upload must be 404; 'denied by egress' polled from the Gitea log; 4 MB attachment
  cap; Actions off; fail on [E] / 'invalid entry'; listener cleaned up in trap

leora added 1 commit 2026-10-15 20:59:20 +08:00

README: record owner decision to skip the edge gate on the hosted instance; REGISTER_MANUAL_CONFIRM as emergency switch 56ed6a277c

leora added 1 commit 2026-10-15 21:10:42 +08:00

README: move hosted-instance decision note to private ops notes; clarify REGISTER_MANUAL_CONFIRM scope 95d843d7dc

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin agent-native-signup:agent-native-signup

git checkout agent-native-signup

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leora/gitea-selfhost#4