esh-pfi-infrastructure/persistent-memory.d/2026-10-01-gitea-s-webhook-allowed-host-list-external-10-0.md

⚠ Gitea's [webhook] ALLOWED_HOST_LIST = external, 10.0.0.0/8 silently REJECTS headscale mesh IPs (100.64.0.0/10)

[2026-10-01] ⚠ Gitea's [webhook] ALLOWED_HOST_LIST = external, 10.0.0.0/8 silently REJECTS headscale mesh IPs (100.64.0.0/10). The test API still returns 204 and nothing arrives. The vh/arbo hook therefore targets irv-ml1's LAN 10.6.110.50:9009; the secret was re-set and a delivery is verified (deploy ran 04:41). A Gitea webhook PATCH without secret and branch_filter drops both, so always resend them.