mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-09-27 19:11:53 +02:00
ARUNAVO RAYandGitHub
0c41fac9c0
Three fixes for the two problems reported in #366: 1. Auto-trust registered SSO identity provider origins. better-auth 1.6.23 (shipped in v3.21.0) added SSRF hardening to the SSO plugin: sign-in rejects IdP endpoints whose hostnames resolve to private addresses unless the origin is in trustedOrigins. Homelab split-DNS setups (IdP domain resolving to a LAN IP from inside the container) broke on every sign-in with a 400. Registering a provider is an explicit operator action, so its issuer and endpoint origins are now added to trusted origins automatically. 2. Surface SSO sign-in errors in the login form. The auth client resolves with { data, error } instead of throwing, so server-side rejections were silently swallowed - the button flipped back from "Redirecting..." with no feedback and nothing in the logs. 3. Honor deleteFromGitea (CLEANUP_DELETE_FROM_GITEA). It was documented as "Delete repositories from Gitea" defaulting to false, but cleanup never read it and always archived/deleted orphans on the Gitea side. It now gates the Gitea-side operation: when disabled (default), orphans are only marked archived or removed in gitea-mirror's own database and the Gitea/Forgejo copies stay untouched. Verified end to end against a live server: sign-in with a private-IP IdP returns 400 discovery_private_host on v3.27.1 and a 200 with the authorization URL on this branch; the login form now shows the server error as a toast; delete cleanup with the flag off removes only the DB row while the flag on contacts Gitea.
Gitea Mirror Documentation
This folder contains engineering and operations references for the open-source Gitea Mirror project. Each guide focuses on the parts of the system that still require bespoke explanation beyond the in-app help and the main README.md.
Available Guides
Core workflow
- DEVELOPMENT_WORKFLOW.md – Set up a local environment, run scripts, and understand the repo layout (app + marketing site).
- ENVIRONMENT_VARIABLES.md – Complete reference for every configuration flag supported by the app and Docker images.
- NIX_DEPLOYMENT.md – User-facing deployment guide for Nix and NixOS.
- NIX_DISTRIBUTION.md – Maintainer notes for packaging, releases, and distribution strategy.
Reliability & recovery
- GRACEFUL_SHUTDOWN.md – How signal handling, shutdown coordination, and job persistence work in v3.
- RECOVERY_IMPROVEMENTS.md – Deep dive into the startup recovery workflow and supporting scripts.
Authentication
- SSO-OIDC-SETUP.md – Configure OIDC/SSO providers through the admin UI.
- SSO_TESTING.md – Recipes for local and staging SSO testing (Google, Keycloak, mock providers).
If you are looking for customer-facing playbooks, see the MDX use cases under www/src/pages/use-cases/.
Quick start for local development
git clone https://github.com/RayLabsHQ/gitea-mirror.git
cd gitea-mirror
bun run setup # installs deps and seeds the SQLite DB
bun run dev # starts the Astro/Bun app on http://localhost:4321
The first user you create locally becomes the administrator. All other configuration—GitHub owners, Gitea targets, scheduling, cleanup—is done through the Configuration screen in the UI.
Contributing & support
- 🎯 Contribution guide: ../CONTRIBUTING.md
- 🐞 Issues & feature requests: https://github.com/RayLabsHQ/gitea-mirror/issues
- 💬 Discussions: https://github.com/RayLabsHQ/gitea-mirror/discussions
- 🔐 Security policy & advisories: https://github.com/RayLabsHQ/gitea-mirror/security