#3307·GitNexus

auto-sync: support self-hosted Git hosts (custom remote_urls domain)

Author: walnut-tomCreated Sep 17, 2026Updated Sep 17, 2026

Problem

gitnexus auto-sync rejects self-hosted Git remotes. Any remote_urls entry whose host is not exactly github.com, gitlab.com, or gitee.com fails config validation and the whole sync is skipped:

[auto-sync] Invalid watch_config.yml: projects[0].remote_urls[0] host must be one of github.com, gitlab.com, or gitee.com; ... Auto sync is skipped.

Use case

Company self-hosted GitLab over SSH (SCP form), e.g.:

projects:
  - local_path: /data/gitnexus/repos
    branches: [main]
    remote_urls:
      - [email protected]:group/repo.git

Same git@host:group/repo.git SCP shape as the allowed hosts, just a custom domain. HTTPS is not required.

Why this should be safe

  • Clone target is already namespaced by full identity (runner.ts:getConfiguredRepoPath + getAutoSyncRepoIdentity): {local_path}/{host}/{namespace...}/{repo}, so a custom host cannot collide with github.com/... entries.
  • validateAutoSyncRemoteUrl already enforces no query/fragment, no traversal, strict repo-name charset — only the host set needs relaxing.
  • cloneOrPull with allowAutoSyncSsh delegates to the same validator, so no second host gate to change.

Suggestion

Allow custom SSH hosts for auto-sync, e.g. one of:

  1. Accept any syntactically valid git@<host>:<path> SCP host by default (keep path/name/branch validation as-is), or
  2. Add an opt-in per-config allowlist, e.g. allowed_hosts: [gitlab.mycompany.com], merged with the built-in three.

Option 2 keeps the current secure default while unblocking self-hosted users. Happy to test a snapshot build against our internal GitLab.

Repro

  1. gitnexus auto-sync init
  2. Put a self-hosted SSH URL in remote_urls (see above).
  3. gitnexus auto-sync start -> validation error, sync skipped.

Environment

  • gitnexus@latest, macOS/Linux
  • Remote: self-hosted GitLab, SSH SCP form

Source: abhigyanpatwari/GitNexus