From 76f463857edb77732c8d89e0004489ce209b615a Mon Sep 17 00:00:00 2001
From: Brooke <brooke@myco.systems>
Date: Tue, 1 Sep 2026 15:08:26 -0400
Subject: [PATCH] set reasonable defaults for webhook, service login, and api
 request timeouts/limits

---
 .env.sample  | 10 ++++++++++
 app.ini.tmpl | 11 +++++++++++
 2 files changed, 21 insertions(+)

diff --git a/.env.sample b/.env.sample
index fad5615..b36a956 100644
--- a/.env.sample
+++ b/.env.sample
@@ -43,6 +43,16 @@ GITEA_CACHE_ADAPTER=memory
 GITEA_CACHE_HOST=
 GITEA_CACHE_ITEM_TTL=16h
 
+GITEA_LOGIN_MAX_FAILED_ATTEMPTS=5
+GITEA_LOGIN_LOCKOUT_DURATION=1h
+
+GITEA_WEBHOOK_ALLOWED_HOST_LIST=external,loopback
+GITEA_WEBHOOK_DELIVER_TIMEOUT=5
+
+GITEA_API_MAX_RESPONSE_ITEMS=50
+GITEA_API_DEFAULT_PAGING_NUM=20
+GITEA_API_ENABLE_SWAGGER=false
+
 GITEA_REPO_UPLOAD_ENABLED=true
 GITEA_REPO_UPLOAD_ALLOWED_TYPES=*/*
 GITEA_REPO_UPLOAD_MAX_SIZE=50
diff --git a/app.ini.tmpl b/app.ini.tmpl
index b9deb35..acbe787 100644
--- a/app.ini.tmpl
+++ b/app.ini.tmpl
@@ -45,6 +45,12 @@ ALLOWED_USER_VISIBILITY_MODES = {{ env "GITEA_ALLOWED_USER_VISIBILITY_MODES" }}
 DEFAULT_ORG_VISIBILITY = {{ env "GITEA_DEFAULT_ORG_VISIBILITY" }}
 REQUIRE_SIGNIN_VIEW = {{ env "GITEA_REQUIRE_SIGNIN_VIEW" }}
 ENABLE_INTERNAL_SIGNIN = {{ env "GITEA_ENABLE_INTERNAL_SIGNIN" }}
+MAX_FAILED_ATTEMPTS = {{ or (env "GITEA_LOGIN_MAX_FAILED_ATTEMPTS") "5" }}
+LOCKOUT_DURATION = {{ or (env "GITEA_LOGIN_LOCKOUT_DURATION") "1h" }}
+
+[webhook]
+ALLOWED_HOST_LIST = {{ or (env "GITEA_WEBHOOK_ALLOWED_HOST_LIST) "external,loopback" }}
+DELIVER_TIMEOUT = {{ or (env "GITEA_WEBHOOK_DELIVER_TIMEOUT) "5" }}
 
 [openid]
 ENABLE_OPENID_SIGNIN = {{ env "GITEA_ENABLE_OPENID_SIGNIN" }}
@@ -154,3 +160,8 @@ ENABLED_ISSUE_BY_LABEL = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL" }}
 ENABLED_ISSUE_BY_REPOSITORY = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY" }}
 TOKEN = {{ secret "metrics_token" }}
 {{ end }}
+
+[api]
+MAX_RESPONSE_ITEMS = {{ or (env "GITEA_API_MAX_RESPONSE_ITEMS") "50" }}
+DEFAULT_PAGING_NUM = {{ or (env "GITEA_API_DEFAULT_PAGING_NUM") "20" }}
+ENABLE_SWAGGER = {{ or (env "GITEA_API_ENABLE_SWAGGER") "false" }}
\ No newline at end of file
-- 
2.54.0