Prevent external users joining gitea instance

[allanbowe]

Thankyou! This fixed it up.

[fbartels]

@staff maybe it would be an idea to change the app that the default is a disabled registration. Sign in is the still possible with oauth.

[SansGuidon]

I've also lost quite some time kicking accounts and repositories,
in the end I've combined some of the options below (don't forget the [service] section marker and also restart after the changes !)

[service]
DISABLE_REGISTRATION = True
REGISTER_MANUAL_CONFIRM = True
EMAIL_DOMAIN_ALLOWLIST = XX_your_domain_here_XX,cloudron.local
DEFAULT_USER_IS_RESTRICTED = True

It's overkill if all are used at the same time, but depending on the needs and paranoia, it can be useful

[infogulch]

+1 to "change the app so that the default is a disabled registration". I just had a big mess to clean up because of this. https://forum.cloudron.io/topic/14053/clean-up-external-users-that-have-accessed-gitea-instance

At the very least these configs should be mentioned in the admin checklist.

[SansGuidon]

@girish could you please have a look at the suggestions here above about disabling registration by default to prevent spam?

[joseph]

Isn't it already false by default ? https://git.cloudron.io/packages/gitea-app/-/blob/master/app.ini.template?ref_type=heads#L78

[joseph]

I checked in a new install and registration is disabled by default afaict .

[SansGuidon]

@joseph said in Prevent external users joining gitea instance:

Isn't it already false by default ? https://git.cloudron.io/packages/gitea-app/-/blob/master/app.ini.template?ref_type=heads#L78

I believe the flag should be set to True not False to block spam

[joseph]

@SansGuidon of course Not sure what i was thinking... Which makes me wonder how come I didn't find any registration button .

[infogulch]

Maybe because the next line is SHOW_REGISTRATION_BUTTON = false. Not sure what this combination of features does, maybe it hides the register button but allows direct POST requests to the endpoint anyway?

[infogulch]

This post is deleted!