mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-09-23 09:01:51 +02:00
ARUNAVO RAYandGitHub
c6157cdaad
* fix(security): guard connection tests, close sign-up and scope SSO providers Fixes the four privately reported issues GHSA-9m33-xfrc-5jxw, GHSA-6m23-28hh-gjh2, GHSA-2hpx-83vg-gm45 and GHSA-5pp8-r7f5-6q8p. - The Gitea and GitHub test-connection routes require a signed-in user. They were the only non-public API routes without a guard and made a server side request to any URL in the body. - Email sign-up is refused server side once an account exists unless AUTH_ALLOW_SIGNUP=true. Only the signup page redirected before; the endpoint accepted new accounts from anyone reaching the instance. - SSO providers are scoped to their owner for list, update and delete, and the client secret is never returned. An empty secret on update keeps the stored one, and the form says so. - HttpError messages carry the status only; the upstream body stays on the response field for logs and never reaches API clients. - A narrow outbound guard for user supplied URLs (connection tests, OIDC discovery, ntfy, Gotify, Apprise, webhook): link local and cloud metadata addresses are refused, host names are resolved and checked, and redirects are not followed. Private networks stay allowed since mirroring to a LAN Gitea is the normal deployment. * fix(security): pin plain http requests to the checked address The guard resolved a host name and checked its addresses, but fetch resolved the name a second time, so a name that changes its answer between the two lookups could still reach a link local address. Plain http requests now go to the address the check saw, with the original name in the Host header. https keeps the name: the certificate is validated against it and the metadata services speak no TLS.
Gitea Mirror Documentation
This folder contains engineering and operations references for the open-source Gitea Mirror project. Each guide focuses on the parts of the system that still require bespoke explanation beyond the in-app help and the main README.md.
Available Guides
Core workflow
- DEVELOPMENT_WORKFLOW.md – Set up a local environment, run scripts, and understand the repo layout (app + marketing site).
- ENVIRONMENT_VARIABLES.md – Complete reference for every configuration flag supported by the app and Docker images.
- NIX_DEPLOYMENT.md – User-facing deployment guide for Nix and NixOS.
- NIX_DISTRIBUTION.md – Maintainer notes for packaging, releases, and distribution strategy.
Reliability & recovery
- GRACEFUL_SHUTDOWN.md – How signal handling, shutdown coordination, and job persistence work in v3.
- RECOVERY_IMPROVEMENTS.md – Deep dive into the startup recovery workflow and supporting scripts.
Authentication
- SSO-OIDC-SETUP.md – Configure OIDC/SSO providers through the admin UI.
- SSO_TESTING.md – Recipes for local and staging SSO testing (Google, Keycloak, mock providers).
API
- API.md – Create API keys and call the app from scripts, CI pipelines and workflow tools.
Sources and destinations
- SOURCE_PROVIDERS.md – GitHub, GitLab and Gitea/Forgejo as sources: tokens, what each can mirror, the source lock.
- PUSH_TARGETS.md – GitHub and GitLab as destinations: how the push engine works, token scopes, disk usage, what is not mirrored.
The user-facing documentation lives on the website at https://gitea-mirror.raylabs.io/docs/, with its sources under www/src/pages/docs/. If you are looking for playbooks, see the MDX use cases under www/src/pages/use-cases/.
Quick start for local development
git clone https://github.com/RayLabsHQ/gitea-mirror.git
cd gitea-mirror
bun run setup # installs deps and seeds the SQLite DB
bun run dev # starts the Astro/Bun app on http://localhost:4321
The first user you create locally becomes the administrator. All other configuration—GitHub owners, Gitea targets, scheduling, cleanup—is done through the Configuration screen in the UI.
Contributing & support
- 🎯 Contribution guide: ../CONTRIBUTING.md
- 🐞 Issues & feature requests: https://github.com/RayLabsHQ/gitea-mirror/issues
- 💬 Discussions: https://github.com/RayLabsHQ/gitea-mirror/discussions
- 🔐 Security policy & advisories: https://github.com/RayLabsHQ/gitea-mirror/security