Repository navigation
ci: allow Appwrite's URL resolver in the hardened scenario - #25
Merged
Merged
Conversation
With the browser on by default, the smoke test takes a screenshot in every
scenario. Under restricted egress the API refused it with 400 ("Hostname
example.com does not resolve"): Appwrite 2.4.0 and later check avatar and
screenshot URLs through _APP_DNS_EXTERNAL (8.8.8.8), which the policy
blocked. The hardened values now allow it, as docs/networking.md tells users
to, and troubleshooting names the error.
levivannoort
added
the
skip-changelog
🟢 Tier S · Ready to mergeThe hardened CI values now allow Appwrite's external URL resolver over DNS, and the troubleshooting guide documents the corresponding hostname-resolution error for site screenshots. The networking guide already describes the resolver and the extra egress rule.
📂 Walkthrough · 2
🔇 Filtered out · 1Findings Hansi considered but did not post.
Reviewed |
![hansi-codes[bot]](https://avatars.githubusercontent.com/in/5046327?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow-up to #24, merged before this commit landed. With the browser on by default, every install scenario now takes a screenshot in
hack/smoke.sh. Inhardened(egress restricted) the API refused it with 400:Invalid url param: Hostname example.com does not resolve.That's Appwrite 2.4.0+ behaviour. Before fetching an avatar, screenshot or migration URL, Appwrite checks the host through its own resolver (
_APP_DNS_EXTERNAL, by default 8.8.8.8), which the egress policy blocked. Users withnetworkPolicy.egress.enabledhit the same 400.ci/hardened-values.yamlallows 8.8.8.8 on port 53, asdocs/networking.mdtells users to.docs/troubleshooting.md(Site deployments log "Screenshot capturing failed") names the error and points to the setting.skip-changelog: CI values and docs only.Until this merges,
main's hardened install scenario fails on the screenshot.Testing
helm lint --strictwith the hardened values; the egress policy renders the extra rule.