Make the runner egress proxy always-on now that the allowlist is gone #784

New issue

Open

opened 2026-08-11 23:35:10 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-11 23:35:10 +00:00

Member

a2f88cf dropped the destination allowlist on 2026-08-11
(config-revision: 2026-08-11-open-destinations). The current config is
http_access allow CONNECT SSL_ports, so Squid tunnels CONNECT to any host on
443.

That removes the reason the proxy was opt-in. Deny-by-default was what made
global proxying dangerous, because every unlisted destination would have broken.

Fix

Set HTTP_PROXY, HTTPS_PROXY, and NO_PROXY in the runner envs: blocks
beside the existing FORGEJO_EGRESS_PROXY. One change here replaces the
per-repository wrappers.

Constraints

NO_PROXY must cover Forgejo, or a checkout deadlocks against its own ingress.
NO_PROXY must cover the in-cluster registry. Squid allows CONNECT on 443
only, and the DinD daemons carry --insecure-registry=192.168.0.194:30500,
which is plain HTTP.
Anything else fetching over plain HTTP breaks the same way.

Relationship to the MTU issue

This is a workaround for the MTU defect, not a fix. If the MTU issue lands
first, this becomes optional rather than necessary.

`a2f88cf` dropped the destination allowlist on 2026-08-11 (`config-revision: 2026-08-11-open-destinations`). The current config is `http_access allow CONNECT SSL_ports`, so Squid tunnels CONNECT to any host on 443. That removes the reason the proxy was opt-in. Deny-by-default was what made global proxying dangerous, because every unlisted destination would have broken. ## Fix Set `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` in the runner `envs:` blocks beside the existing `FORGEJO_EGRESS_PROXY`. One change here replaces the per-repository wrappers. ## Constraints * `NO_PROXY` must cover Forgejo, or a checkout deadlocks against its own ingress. * `NO_PROXY` must cover the in-cluster registry. Squid allows CONNECT on 443 only, and the DinD daemons carry `--insecure-registry=192.168.0.194:30500`, which is plain HTTP. * Anything else fetching over plain HTTP breaks the same way. ## Relationship to the MTU issue This is a workaround for the MTU defect, not a fix. If the MTU issue lands first, this becomes optional rather than necessary.

coilyco-ops referenced this issue

2026-08-14 05:10:02 +00:00

galaxy-gen CI has been red since 03:04 today: rustup downloads time out on the gaming runner, the #783 symptom class is back #824

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#784

No description provided.

Rows
Columns