fix: allow code.forgejo.org through the runner egress proxy #779

Merged

coilysiren merged 1 commit from chore/egress-allow-code-forgejo into main

2026-08-11 08:44:11 +00:00

coilyco-ops commented

2026-08-11 08:40:47 +00:00

Member

forgejo-runner-validate pulls its hook from code.forgejo.org, which is absent from the Squid allowlist. Any job that routes pre-commit through FORGEJO_EGRESS_PROXY fails the moment that hook environment is cold, because the proxy denies every unlisted host.

Reproduction

Surfaced by coilyco-gaming/sirens-echo#103, whose CI pre-commit step dies after 3s. Inside the same agentic-os:release container:

full network, cold cache - all seven hook environments install, suite green
--add-host code.forgejo.org:127.0.0.1 - fails at Initializing environment for https://code.forgejo.org/forgejo/runner with Failed to connect to code.forgejo.org port 443, matching the CI signature

Why it is not covered today

code.forgejo.org is the upstream Forgejo project, not this instance, so the "keep internal Forgejo, registry, and cluster traffic direct" carve-out does not reach it. It belongs on the allowlist for the same reason github.com does: it serves a pinned pre-commit hook that every catalog repo now runs.

This is the reproduce-first bar the doc sets for allowlist additions.

Scope

one dstdomain entry added
coilyco.io/config-revision bumped so the Deployment rolls the new ConfigMap
docs record the reproduction alongside the existing Telegram, NuGet, and Go-module cases

Additive and revertible. pre-commit run --all-files is green.

Verification after merge

Per the live-verification checklist, an operator should confirm both replicas are ready and that Squid logs show an allowed CONNECT to code.forgejo.org. Re-running sirens-echo#103 CI is the end-to-end check.

`forgejo-runner-validate` pulls its hook from `code.forgejo.org`, which is absent from the Squid allowlist. Any job that routes pre-commit through `FORGEJO_EGRESS_PROXY` fails the moment that hook environment is cold, because the proxy denies every unlisted host. ## Reproduction Surfaced by coilyco-gaming/sirens-echo#103, whose CI pre-commit step dies after 3s. Inside the same `agentic-os:release` container: * full network, cold cache - all seven hook environments install, suite green * `--add-host code.forgejo.org:127.0.0.1` - fails at `Initializing environment for https://code.forgejo.org/forgejo/runner` with `Failed to connect to code.forgejo.org port 443`, matching the CI signature ## Why it is not covered today `code.forgejo.org` is the upstream Forgejo project, not this instance, so the "keep internal Forgejo, registry, and cluster traffic direct" carve-out does not reach it. It belongs on the allowlist for the same reason `github.com` does: it serves a pinned pre-commit hook that every catalog repo now runs. This is the reproduce-first bar the doc sets for allowlist additions. ## Scope * one `dstdomain` entry added * `coilyco.io/config-revision` bumped so the Deployment rolls the new ConfigMap * docs record the reproduction alongside the existing Telegram, NuGet, and Go-module cases Additive and revertible. `pre-commit run --all-files` is green. ## Verification after merge Per the live-verification checklist, an operator should confirm both replicas are ready and that Squid logs show an allowed CONNECT to `code.forgejo.org`. Re-running sirens-echo#103 CI is the end-to-end check.

coilyco-ops added 1 commit

2026-08-11 08:40:47 +00:00

fix: allow code.forgejo.org through the runner egress proxy

TruffleHog / Scan for secrets (pull_request) Successful in 5s

Details

CI / lint (pull_request) Successful in 1m14s

Details

dddbdd0e65

`forgejo-runner-validate` pulls its hook from code.forgejo.org, which was
absent from the Squid allowlist. A job that routes pre-commit through
FORGEJO_EGRESS_PROXY therefore fails the moment that hook environment is
cold, because the proxy denies every unlisted host.

Reproduced against coilyco-gaming/sirens-echo#103: the CI pre-commit step
dies after 3s. Blackholing only code.forgejo.org inside the same
agentic-os:release container reproduces it byte for byte; with the host
reachable the suite is green.

code.forgejo.org is the upstream Forgejo project, not this instance, so the
"keep internal Forgejo traffic direct" carve-out does not cover it. Bumped
the config-revision annotation so the Deployment rolls the new ConfigMap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-11 08:40:47 +00:00

coilyco-ops referenced this pull request from coilyco-gaming/sirens-echo

2026-08-11 08:41:04 +00:00

chore: bump to aos-precommit-v0.18.0 and clear the linter backlog #103