From cacc7710adc14580e52ea1ff7c730d96f068bfe1 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 17 Dec 2025 16:46:43 -0800 Subject: [PATCH] proxies/forge: fix attachment proxying for images This turned out to be a bit complicated, see https://codeberg.org/forgejo/forgejo/issues/6360#issuecomment-9010932 . Pagure images in comments use root-relative Markdown links, like this: ![image.png](/group/repo/issue/raw/files/image.png) but Forgejo renders those relative to *the repo*, not the server root, so they get rendered as something like: However, it does *not* do this for *non-image* root-relative links, so those aren't 'broken'. This means we need to handle *both* cases in the proxying, and we also need to keep in mind that Pagure allows repos without a group. So we can wind up with one, two, three or four folders before /issue. I did some testing and I *think* this should cover all cases. I've tested this does fix images, I haven't tested on a non-image attachment yet (need to find one). Signed-off-by: Adam Williamson --- .../templates/reversepassproxy.forge.conf | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf index 6f71a88e29..1310ebb851 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf @@ -7,6 +7,20 @@ SSLProxyVerify require SSLProxyVerifyDepth 2 SSLProxyCACertificateFile "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" +# Forgejo can't decide whether to render root-relative links as relative +# to the server root or the repo root, and currently behaves differently +# for image and non-image links: +# https://codeberg.org/forgejo/forgejo/issues/6360#issuecomment-9010932 + +# This first match handles cases where the link is rendered relative to +# to repo. As all repos must have an org in Forgejo, if there are more +# than two directories before /issue, this must be repo-relative; the +# third match will be either pagurerepo or pagureorg/pagurerepo +ProxyPassMatch ^/(.+?)/(.+?)/(.+?)/issue/raw/files/(.*)$ https://pagure.io/$3/issue/raw/files/$4 + +# This match handles cases where the link is rendered relative to the +# server root; if we didn't hit the first match, the first match here +# will be pagurerepo or pagureorg/pagurerepo ProxyPassMatch ^/(.+?)/issue/raw/files/(.*)$ https://stg.pagure.io/$1/issue/raw/files/$2 {% endif %}