mirror of
https://github.com/block/buzz.git
synced 2026-11-07 09:52:03 +00:00
eb76c81909
The pre-receive hook curls the relay's own /internal/git/policy callback. By
default it targets the TCP loopback 127.0.0.1:{bind_port}. In a mesh deployment
(e.g. Istio) that loopback port can be iptables-captured by the sidecar, so the
relay's call to itself fails with 'network error reaching policy service' and
every push is rejected.
The relay already serves the same router over its UDS listener (main.rs) when
BUZZ_UDS_PATH is set, so the policy endpoint is already reachable over the
socket — only the hook's curl target needs to change.
- transport.rs: when config.uds_path is set, point BUZZ_HOOK_URL at a
placeholder host (curl ignores host:port under --unix-socket) and pass the
socket path via BUZZ_HOOK_SOCKET. Extract policy_hook_url() as a pure,
unit-testable helper. When uds_path is None, behavior is byte-identical to
before (TCP loopback) — local/dev/CI are untouched.
- hook.rs: add --unix-socket "$BUZZ_HOOK_SOCKET" to the policy curl iff
BUZZ_HOOK_SOCKET is non-empty. --unix-socket is stock libcurl.
- Unit tests for both URL branches.
Pairs with a tf-stacks chart change that sets BUZZ_UDS_PATH + a shared emptyDir
mount; that removes the relay's dependency on the mesh loopback entirely.
Refs RESEARCH/SPROUT_GIT_POLICY_DEPLOY_MISMATCH.md.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>