Clear and concise description of the problem
In #6721, support for exposing woodpecker to a reverse proxy via Unix sockets was introduced.
When this is used, woodpecker-server creates a new socket at a location defined in the config, and the reverse proxy then tries to forward requests to that socket. To do so, it needs to have access to the socket.
If the reverse proxy is under another user that does not share groups (for security), this means that the script starting woodpecker (or the administrator) needs to manually chmod the socket before the proxy can access it.
Suggested solution
Another go application with a web interface that can be exposed over a Unix socket is Gitea, which provides the UNIX_SOCKET_PERMISSION variable that users can configure to set the permissions.
Adding something similar to woodpecker would make using the Unix socket support easier.
Alternative
It is probably possible to use some systemd feature to set the permissions, it is certainly possible to use a shell script to do so, and putting both services under the same user "solves" this issue at the cost of security.
If using some systemd feature or a script is intended, documenting this might be helpful, since I am probably not the only person unaware of that.
Additional context
No response
Validations
Clear and concise description of the problem
In #6721, support for exposing woodpecker to a reverse proxy via Unix sockets was introduced.
When this is used, woodpecker-server creates a new socket at a location defined in the config, and the reverse proxy then tries to forward requests to that socket. To do so, it needs to have access to the socket.
If the reverse proxy is under another user that does not share groups (for security), this means that the script starting woodpecker (or the administrator) needs to manually
chmodthe socket before the proxy can access it.Suggested solution
Another go application with a web interface that can be exposed over a Unix socket is Gitea, which provides the
UNIX_SOCKET_PERMISSIONvariable that users can configure to set the permissions.Adding something similar to woodpecker would make using the Unix socket support easier.
Alternative
It is probably possible to use some systemd feature to set the permissions, it is certainly possible to use a shell script to do so, and putting both services under the same user "solves" this issue at the cost of security.
If using some systemd feature or a script is intended, documenting this might be helpful, since I am probably not the only person unaware of that.
Additional context
No response
Validations
nextversion already [https://woodpecker-ci.org/versions]