What's the difference of WOODPECKER_DEV_GITEA_OAUTH_URL and WOODPECKER_DEV_OAUTH_HOST?

[anbraten]

What's the difference of WOODPECKER_DEV_GITEA_OAUTH_URL and WOODPECKER_DEV_OAUTH_HOST?

We might need to start cleaning them up again or adding some advanced setup docs as users seem to be confused about all the host settings #3651 😅

[qwerty287]

WOODPECKER_DEV_GITEA_OAUTH_URL: user-facing address of the gitea server, so you can access the web ui but use an internal address for api calls made by woodpecker
WOODPECKER_DEV_OAUTH_HOST: see https://woodpecker-ci.org/docs/development/getting-started#setup-oauth, but don't ask me why we need a separate one… Couldn't we just always use WOODPECKER_HOST (which is the default anyways)?

[anbraten]

Okay did some testing.

WOODPECKER_DEV_GITEA_OAUTH_URL is what I actually expected WOODPECKER_DEV_OAUTH_HOST to be. WOODPECKER_DEV_GITEA_OAUTH_URL is currently somehow "broken" from what I understand as its used for AuthURL (public facing) the url used to redirect the user to and for TokenURL (the internal address used to exchange the token).

woodpecker/server/forge/gitea/gitea.go

Line 102 in 6abc112

AuthURL: fmt.Sprintf(authorizeTokenURL, c.oauth2URL),

[anbraten]

I need to check why we would want the red WOODPECKER_HOST and purple WOODPECKER_DEV_OAUTH_HOST to be different.

WOODPECKER_DEV_GITEA_OAUTH_URL should just be used for the redirect on login (blue) and the orange one should actually be green WOODPECKER_GITEA_URL again as calling the token exchange endpoint from within woodpecker works pretty similar to calling the general gitea api.

[anbraten]

We used WOODPECKER_DEV_OAUTH_HOST before we had WOODPECKER_WEBHOOK_HOST #1869 to be able to set WOODPECKER_HOST to the internal host while being able to set WOODPECKER_DEV_OAUTH_HOST to the public facing endpoint.

[zc-devs]

Schema above is confusing:

1. I would pick up more real names. For example, gitea.example.org, woodpecker.example.org for public domains and gitea.local, woodpecker-server.local, woodpecker-agent.local for internal.
2. Web-browser goes to http://woodpecker.example.org:8000 then.
3. Login button should redirect to http://gitea.example.org:3000, not localhost.
4. Gitea should redirect to http://woodpecker.example.org:8000, not localhost.
   Edit:
5. Connections 1, 2 are not direct, they go via Browser. However, in addition to them there might be oAuth back-channel communication.

[zc-devs]

start cleaning them up again

and maybe make them "general available" instead of "dev".