2026-06-11 balda: document Smokescreen PROXY_ALLOW_RANGES fix for 407

2026-06-11 21:30:57 +06:00
parent d742a619fc
commit baeb799db6
1 changed files with 33 additions and 1 deletions
@@ -1,6 +1,6 @@
 # Balda Setup & Status

-> Last updated: 2026-06-07
+> Last updated: 2026-06-11

 ## Runtime

@@ -100,6 +100,38 @@ Webhook bot URL updated in Zulip DB via `docker exec psql` on 2026-06-07:

 ---

+## Smokescreen SSRF Proxy — Allow Private Ranges (Fixed 2026-06-11)
+
+**Symptom:** Zulip outgoing webhook to Balda fails with HTTP 407.
+Zulip logs: `client: OutgoingWebhookResponse` + "Failure! Third party responded with 407".
+
+**Root cause:** Zulip runs Smokescreen (SSRF proxy) for all outgoing HTTP.
+`host.docker.internal` resolves to a private IP (`192.168.5.x`), which Smokescreen
+blocks by default. A `docker restart` does NOT recreate containers, so env vars
+added to docker-compose aren't picked up — must use `docker compose up -d`.
+
+**Fix:** Added to `~/Developer/zulip/docker-compose.yml` under the `zulip` service env:
+
+```yaml
+PROXY_ALLOW_RANGES: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+```
+
+Then recreated containers:
+
+```bash
+cd ~/Developer/zulip
+docker compose up -d
+```
+
+Smokescreen now starts with `--allow-range` flags for all RFC1918 ranges.
+Verify with: `docker exec zulip-zulip-1 ps aux | grep smokescreen`
+
+**Note:** `SETTING_ALLOW_BOTS_TO_MAKE_REQUESTS_TO_PRIVATE_ADDRESSES: "True"` was already
+set but doesn't affect Smokescreen's `--allow-range` flags — it controls a different
+check. `PROXY_ALLOW_RANGES` is the correct env var.
+
+---
+
 ## DeepSeek Provider via norma-local Fork

 Balda's `openai` provider type in norma hardcoded `api.openai.com`. To support