Redirect given repositories to others on another Gitea instance only if authenticated

[Benjamin-Loison]

Feature Description

Notably links to issue and issue comments.

The authentication aspect makes it not trivial in NGINX configuration but is necessary to avoid leaking names of a given repository and target Gitea instance.

In the context of #152.

Screenshots

No response

[Benjamin-Loison]

Could IP filter for my own usage.

[Benjamin-Loison]

If just block access for other persons it is not fine but I am considering private repositories where collaborators have access on the new Gitea instance, so it may be acceptable but keeping a read access for them would be nice. So should redirect based on IP and keep as is for other IPs, not block.

DuckDuckGo search NGINX IP restrict.

/etc/nginx/sites-enabled/gitea:

    location = /test {
        allow XXX.XXX.XXX.XXX;
        deny all;
        return 301 /new_test;
    }

From LemnosLife VPS not having above IP (while I have correctly sudo service nginx reload):

curl -I https://gitea.lemnoslife.com/test

Output:

HTTP/2 301 
server: nginx/1.22.1
date: Wed, 30 Apr 2025 02:15:46 GMT
content-type: text/html
content-length: 169
location: https://gitea.lemnoslife.com/new_test

[Benjamin-Loison]

Even if comment allow it still works fine.

DuckDuckGo and Google search nginx deny all not working.

[Benjamin-Loison]

Changing location order does not help, source: the Stack Overflow answer 32282066.

[Benjamin-Loison]

grep -Er 'allow|deny'

does not return anything, so I can't compare.

[Benjamin-Loison]

YouTube-operational-API/wiki/Home/1c7139f68af217d41d0a201a97eaecf87c139a8b uses deny all;.

If I specify within server deny all; then it works fine for https://gitea.lemnoslife.com.

[Benjamin-Loison]

DuckDuckGo search nginx redirect only a given IP.

[Benjamin-Loison]

Without location the Server Fault answer 380843 works fine.

[Benjamin-Loison]

The Stack Overflow answer 55257249 gives some syntax.

/etc/nginx/sites-enabled/gitea:

geo $me {
  default 0;
  XXX.XXX.XXX.XXX 1;
}

...

    if ($me) {
        rewrite ^/Benjamin_Loison/(CENSORED_0|CENSORED_1)_private(.*) https://git.CENSORED.fr/Benjamin_Loison/$1$2;
    }

works as wanted.

[Benjamin-Loison]

From my IP:

curl -I https://gitea.lemnoslife.com/Benjamin_Loison/CENSORED_private/issues/42

Output:

HTTP/2 302 
server: nginx/1.22.1
date: Wed, 30 Apr 2025 02:44:30 GMT
content-type: text/html
content-length: 145
location: https://git.CENSORED.fr/Benjamin_Loison/CENSORED/issues/42

From LemnosLife VPS:

curl -I https://gitea.lemnoslife.com/Benjamin_Loison/CENSORED_private/issues/42

Output:

HTTP/2 404 
server: nginx/1.22.1
date: Wed, 30 Apr 2025 02:45:11 GMT
content-type: text/plain;charset=utf-8
content-length: 11
cache-control: max-age=0, private, must-revalidate, no-transform
set-cookie: i_like_gitea=XXXXXXXXXXXXXXXX; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _csrf=XXXXXXXXXXX_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

While Benjamin_Loison/Linguee_webscraper/issues/4 works still fine for instance.

[Benjamin-Loison]

May have to disable the IP redirection due to #128.

[Benjamin-Loison]

This IP based solution supports multiple ones, this is nice.

[Benjamin-Loison]

Maybe can leverage a given cookie having a given value in NGINX configuration.

Otherwise can call a script and it redirects accordingly if necessary.

[Benjamin-Loison]

Benjamin_Loison/nginx/issues/6 would help.