Review fixes: ALLOWED_HOST_LIST explicit, no password basic auth, bounded storage, rollout order, adversarial e2e
- drop EGRESS_MODE; [security] ALLOWED_HOST_LIST = external (Gitea 28+; [webhook] on 1.23)
- ENABLE_BASIC_AUTHENTICATION = false (tokens still work); e2e clones with the token
- packages and Actions off; attachments and web uploads capped at 4 MB / 3 files
- README: rollout order (edge rate limit first, verify, then captcha off; rollback),
storage notes (proxy body cap, disk alert, user purge), REGISTER_MANUAL_CONFIRM emergency
switch, EMAIL_DOMAIN_ALLOWLIST/BLOCKLIST, known gaps (email enumeration, /join reserved names)
- e2e: password basic auth refused (API + git push), token works, 11th repo / org / package
refused, webhook to 127.0.0.1 not delivered, sign-up burst marked PENDING (edge rule)
leora
c8d58daabf