Support ARTIFACT_ROOT_URL

[wolfogre]

Fix https://gitea.com/gitea/act_runner/issues/541

Users may use a non-ROOT_URL address to register a runner, since the ROOT_URL may be a public address listened by a reverse proxy.

Most communication between runners and Gitea (like calling API and cloning repo) uses the URL provided during registration, except for uploading or downloading artifacts. These addresses are generated by Gitea and provided to the runners. Gitea always uses the ROOT_URL to generate these addresses, causing the runner to upload or download artifacts from the public network.

This PR adds an new configuration ARTIFACT_ROOT_URL to indicate the address for uploading or downloading artifacts. If not specified, the ROOT_URL is still used.

[wxiaoguang]

I think if there is such a use case, we should make the "http ctx" support "X-Forwarded-Xxx" headers, then no need to add any new config option.

Ref:

• OCI Registry uses AppURL (ROOT_URL) no matter which address the client is connecting to (more Multi-Domain fallout) #29591 (comment)

[wolfogre]

I think if there is such a use case, we should make the "http ctx" support "X-Forwarded-Xxx" headers, then no need to add any new config option.

Ref:

• OCI Registry uses AppURL (ROOT_URL) no matter which address the client is connecting to (more Multi-Domain fallout) #29591 (comment)

I have thought about this, but I'm not sure if it could cause more problems.

In my mind, it's something like:

1. If there is X-Forwarded-Xxx, it's behind a proxy so it's OK to use X-Forwarded-Xxx.
2. If there's no X-Forwarded-Xxx, always assume there's no proxy, use Host even if it's different from ROOT_URL.

And you have got the point: "X-Forwarded-Xxx is not standard." We cannot assume there's no proxy if there's no such header.

[wxiaoguang]

2.

And you have got the point: "X-Forwarded-Xxx is not standard." We cannot assume there's no proxy if there's no such header.

It is de-facto standard. I am sure we should introduce it sooner or later.

Let me describe what I understand now (correct me if I am wrong):

• Runner accesses https://non-app-url/xxx and expects to get a full URL https://non-app-url/yyy, right?

If it is so, I will propose a general solution, we only need to tell end users: please configure your reverse proxy properly , and actually, it has been well documented for long time: https://docs.gitea.com/administration/reverse-proxies#nginx

[wolfogre]

And you have got the point: "X-Forwarded-Xxx is not standard." We cannot assume there's no proxy if there's no such header.

It is de-facto standard. I am sure we should introduce it sooner or later.

Let me describe what I understand now (correct me if I am wrong):

• Runner accesses https://non-app-url/xxx and expects to get a full URL https://non-app-url/yyy, right?

If it is so, I will propose a general solution, we only need to tell end users: please configure your reverse proxy properly , and actually, it has been well documented for long time: docs.gitea.com/administration/reverse-proxies#nginx

Your understanding is completely right.

If we required any proxy for Gitea provides X-Forwarded-Xxx and Gitea can assume there's no proxy if there's not such header, you are right, no need to add any new config option, and I believe things will be much easier.

[wxiaoguang]

If there's no X-Forwarded-Xxx, always assume there's no proxy, use Host even if it's different from ROOT_URL.

For this case, I think it could also be right in most cases. I will try to propose a solution.

ps: do we need it in 1.22?

[wolfogre]

ps: do we need it in 1.22?

You mean the issue of artifacts? I think it's not a hurry since there are some workarounds.

But I agree to do it in 1.22 since it's just RC1, and it doesn't break anything as long as users configure the proxy correctly.

[wxiaoguang]

Does #30885 look good to you? Will write some tests.

[wolfogre]

Does #30885 look good to you? Will write some tests.

Let's follow it, this PR can be closed now.