bitborg/bitborg-infra
Bevaka
2
0
Avgrena
Du har redan avgrenat bitborg-infra
 0
Kod Ärenden 64 Ändringsförfrågningar 3 Projekt 1 Utgåvor Paket Wiki Aktiviteter Actions

Org-create is open + orgs are never quota'd → total per-user cap bypass (disk-fill outage) #121

Nytt ärende
Stängd
öppnade 2026-07-19 06:56:05 +00:00 av supernaut · 1 kommentar
supernaut kommenterad 2026-07-19 06:56:05 +00:00
Ägare
Kopiera länk

Severity: CRITICAL — pre-onboarding infra audit (2026-07-19).

Total per-user cap bypass via organizations

  • ansible/roles/forgejo/defaults/main.yml:43 forgejo_default_allow_create_org: true and app.ini.j2:91 DEFAULT_ALLOW_CREATE_ORGANIZATION = true → anyone can create orgs.
  • The reconciler only iterates /api/v1/admin/users and never enumerates orgs (org quota is a deferred TODO in gitborg-reconciler.sh.j2). Organizations are separate quota owners → they fall to [quota.default] = -1 = unlimited.

Impact

Any user (including one in the JIT window, or anyone at all if the reconciler is down — see the fail-open quota issue) can create an org and push unlimited git/LFS/packages into it, bypassing every per-tier cap and filling the shared 60 GB data volume. Because Forgejo + Postgres + Kanidm share that volume, filling it is a full-instance outage.

Ask

  1. Flip forgejo_default_allow_create_org: false now that the reconciler is live (the defaults comment notes org-create is a tier privilege the reconciler grants; flipping false is now safe). ⚠️ apply-day: confirm the reconciler grants org-create to entitled users first.
  2. Add org enumeration + a default org quota group to the reconciler.

Effort M.

**Severity: CRITICAL** — pre-onboarding infra audit (2026-07-19). ### Total per-user cap bypass via organizations - `ansible/roles/forgejo/defaults/main.yml:43` `forgejo_default_allow_create_org: true` and `app.ini.j2:91` `DEFAULT_ALLOW_CREATE_ORGANIZATION = true` → **anyone** can create orgs. - The reconciler only iterates `/api/v1/admin/users` and **never enumerates orgs** (org quota is a deferred TODO in `gitborg-reconciler.sh.j2`). Organizations are separate quota owners → they fall to `[quota.default] = -1 = unlimited`. ### Impact Any user (including one in the JIT window, or anyone at all if the reconciler is down — see the fail-open quota issue) can create an org and push **unlimited** git/LFS/packages into it, bypassing every per-tier cap and filling the shared **60 GB** data volume. Because Forgejo + Postgres + Kanidm share that volume, filling it is a **full-instance outage**. ### Ask 1. Flip `forgejo_default_allow_create_org: false` now that the reconciler is live (the defaults comment notes org-create is a tier privilege the reconciler grants; flipping false is now safe). ⚠️ apply-day: confirm the reconciler grants org-create to entitled users first. 2. Add org enumeration + a default org quota group to the reconciler. Effort M.
supernaut kommenterad 2026-07-19 20:14:17 +00:00
Upphovsperson
Ägare
Kopiera länk

✅ Resolved + verified live (2026-07-19) — both parts applied:

  • Part 1 (PR #150): DEFAULT_ALLOW_CREATE_ORGANIZATION = false — confirmed in the running Forgejo config. Org-create is now gated to ent_orgs members via the reconciler (which PATCHes it per-user every 5 min).
  • Part 2 (PR #151): the reconciler now enforces org quotas. org-default (size:all = 5 GiB) + org-unlimited groups created; the gitborg org is exempted to org-unlimited (verified: org-unlimited members = [bitborg]); reconciler last-run status 0. New tenant orgs get the 5 GiB total cap — closing the bypass where a user pushed unlimited data into an org and filled the shared data volume.

Validated via a reconciler dry-run (org enumeration against /api/v1/admin/orgs works) then a live run. Forgejo healthy after the app.ini restart.

✅ **Resolved + verified live** (2026-07-19) — both parts applied: - **Part 1 (PR #150):** `DEFAULT_ALLOW_CREATE_ORGANIZATION = false` — confirmed in the *running* Forgejo config. Org-create is now gated to `ent_orgs` members via the reconciler (which PATCHes it per-user every 5 min). - **Part 2 (PR #151):** the reconciler now enforces org quotas. `org-default` (size:all = 5 GiB) + `org-unlimited` groups created; the `gitborg` org is exempted to `org-unlimited` (verified: `org-unlimited` members = `[bitborg]`); reconciler last-run status 0. New tenant orgs get the 5 GiB total cap — closing the bypass where a user pushed unlimited data into an org and filled the shared data volume. Validated via a reconciler dry-run (org enumeration against `/api/v1/admin/orgs` works) then a live run. Forgejo healthy after the app.ini restart.
Logga in för att delta i denna konversation.
Ingen gren/etikett specificerad
Grenar Taggar
main
fix/log-retention-and-erasure
feat/billing-reconcile-trigger
chore/renovate-script-pins
Inga resultat hittades.
Etiketter
Rensa etiketter
  
area/backups
Backup & restore

  
area/ci
Actions / runners

  
area/control-panel
Logged-in self-service area

  
area/identity
Kanidm / OIDC / entitlements

  
area/infra
Infrastructure (OpenTofu/Ansible/host)

  
area/observability
Monitoring / logs / analytics

  
area/payments
Billing / payment providers

  
area/security
Security & compliance (incl. ISO 27001)

  
area/storage
Volumes / data / LFS

  
area/web
Public web portal (gitborg-web)

  
blocked
Evaluated and specified, but waiting on an external dependency

  
needs-info
Waiting on the reporter for more information

  
needs-triage
Not yet evaluated

  
ready-for-implementation
Fully specified, ready to be picked up

  
type
bug
 Something is broken

  
type
chore
 Maintenance / housekeeping

  
type
docs
 Documentation

  
type
epic
 High-level roadmap item

  
type
feature
 New capability

  
type
task
 Concrete unit of work

  
wontfix
Will not be actioned

Inga etiketter
area/backups
area/ci
area/control-panel
area/identity
area/infra
area/observability
area/payments
area/security
area/storage
area/web
blocked
needs-info
needs-triage
ready-for-implementation
type
bug
type
chore
type
docs
type
epic
type
feature
type
task
wontfix
Milstolpe
Rensa milstolpe
Inga objekt
Ingen milstolpe
Projekt
Rensa projekt
Inga objekt
Inget projekt
Bitborg Infrastructure
Tilldelade
Rensa tilldelade
Inga tilldelade
1 deltagare
Notiser
Förfallodatum
Förfallodatumet är ogiltigt eller utanför gränserna. Använd formatet "åååå-mm-dd".

Inget förfallodatum satt.

Beroenden

Inga beroenden satta

Referens
bitborg/bitborg-infra#121
Ingen beskrivning angiven.