fix(quota): gate org-create + reconciler deadman + faster reconcile (#120/#121) #150

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/120-121-safe-defenses in i main

2026-07-19 19:59:38 +00:00

supernaut kommenterad

2026-07-19 19:46:55 +00:00

Ägare

Low-risk defenses for the fail-open quota / org-bypass audit findings. (The fail-closed group default is intentionally split into a separate PR — it carries quota-semantics risk.)

Changes

#121 part 1 — forgejo_default_allow_create_org: false (DEFAULT_ALLOW_CREATE_ORGANIZATION = false). Closes "anyone can create an unlimited, un-quota'd org → disk-fill outage". Safe: the reconciler is live (reconciler_apply: true) and PATCHes allow_create_organization per-user to ent_orgs members every run, so entitled users keep it; non-entitled users lose the bypass.
#120 deadman — new ReconcilerStale critical alert ((time() - gitborg_reconciler_last_run_timestamp_seconds)/60 > 30). ReconcilerFailed only fires on a failed run; a dead timer was previously invisible while entitlement sync silently stopped. The metric stamps on every run (success or fail), so staleness == the timer isn't firing.
#120 window — reconcile interval *:0/15 → *:0/5. Bounds how long a new JIT account waits for its tier group (esp. once PR-C makes the group-less default fail-closed).

Validation

ansible-lint (production profile) · --syntax-check · --check --diff renders clean (0 failed); confirmed DEFAULT_ALLOW_CREATE_ORGANIZATION = false, OnCalendar=*:0/5, and the ReconcilerStale rule.

Apply-day note

--tags forgejo,monitoring,reconciler. Confirm the reconciler has granted org-create to any currently-entitled users (it runs every 5 min) — existing entitled users are unaffected; only the global default changes.

Refs #120, #121.

Low-risk defenses for the fail-open quota / org-bypass audit findings. (The fail-*closed* group default is intentionally split into a separate PR — it carries quota-semantics risk.) ## Changes - **#121 part 1** — `forgejo_default_allow_create_org: false` (`DEFAULT_ALLOW_CREATE_ORGANIZATION = false`). Closes "anyone can create an unlimited, un-quota'd org → disk-fill outage". Safe: the reconciler is live (`reconciler_apply: true`) and PATCHes `allow_create_organization` per-user to `ent_orgs` members every run, so entitled users keep it; non-entitled users lose the bypass. - **#120 deadman** — new `ReconcilerStale` critical alert (`(time() - gitborg_reconciler_last_run_timestamp_seconds)/60 > 30`). `ReconcilerFailed` only fires on a *failed* run; a *dead* timer was previously invisible while entitlement sync silently stopped. The metric stamps on every run (success or fail), so staleness == the timer isn't firing. - **#120 window** — reconcile interval `*:0/15 → *:0/5`. Bounds how long a new JIT account waits for its tier group (esp. once PR-C makes the group-less default fail-closed). ## Validation ansible-lint (production profile) · `--syntax-check` · `--check --diff` renders clean (0 failed); confirmed `DEFAULT_ALLOW_CREATE_ORGANIZATION = false`, `OnCalendar=*:0/5`, and the ReconcilerStale rule. ## Apply-day note `--tags forgejo,monitoring,reconciler`. Confirm the reconciler has granted org-create to any currently-entitled users (it runs every 5 min) — existing entitled users are unaffected; only the global default changes. Refs #120, #121.

supernaut lade till 1 incheckning

2026-07-19 19:46:56 +00:00

fix(quota): gate org-create + reconciler deadman + faster reconcile

ci / ci (pull_request) Successful in 3m21s

Detaljer

e27c9b6605

Low-risk defenses for the fail-open quota / org-bypass findings:

- #121: DEFAULT_ALLOW_CREATE_ORGANIZATION=false — the reconciler grants
  org-create per-user to ent_orgs members, so this closes the bypass
  where any user could create an unlimited, un-quota'd org (disk-fill).
- #120: add a ReconcilerStale deadman alert — ReconcilerFailed only
  fires on a failed run, so a dead timer silently stopped entitlement
  sync. The metric stamps on every run, so staleness = timer dead.
- #120: reconcile interval 15 -> 5 min to shrink the new-JIT window.

Validated: ansible-lint (production), --check renders clean (0 failed).

Refs #120, #121.