Allow all Git hosts when allowlist is unset

.env.example

@@ -1,6 +1,6 @@
 PORT=3000
 API_KEY=
-ALLOWED_GIT_HOSTS=gitea.reversed.dev
+ALLOWED_GIT_HOSTS=
 CACHE_TTL_MINUTES=5
 CACHE_SWEEP_INTERVAL_MINUTES=5
 RATE_LIMIT_WINDOW_MINUTES=5

README.md

@@ -79,7 +79,7 @@ curl "http://localhost:3000/ssh/public-key?ssh_key=loc_via_git_ed25519"
 
 ## Repository access
 
-`ALLOWED_GIT_HOSTS` is required and accepts a comma-separated host allowlist, such as `gitea.reversed.dev,github.com`. Set it to `*` only if you explicitly accept arbitrary repository hosts. Local paths, `file://` URLs, non-SSH/HTTPS protocols, and HTTPS URLs containing credentials are rejected.
+`ALLOWED_GIT_HOSTS` is optional. Leave it unset or empty to allow every remote host, or use a comma-separated allowlist such as `gitea.reversed.dev,github.com`. Local paths, `file://` URLs, non-SSH/HTTPS protocols, and HTTPS URLs containing credentials are always rejected.
 
 ## Configuration
 
@@ -88,7 +88,7 @@ Copy `.env.example` to `.env` and adjust:
 ```env
 PORT=3000
 API_KEY=
-ALLOWED_GIT_HOSTS=gitea.reversed.dev
+ALLOWED_GIT_HOSTS=
 CACHE_TTL_MINUTES=5
 CACHE_SWEEP_INTERVAL_MINUTES=5
 RATE_LIMIT_WINDOW_MINUTES=5

docker-compose.yml

@@ -14,7 +14,7 @@ services:
     environment:
       PORT: 3000
       API_KEY: ${API_KEY:-}
-      ALLOWED_GIT_HOSTS: ${ALLOWED_GIT_HOSTS:-gitea.reversed.dev}
+      ALLOWED_GIT_HOSTS: ${ALLOWED_GIT_HOSTS:-}
       CACHE_TTL_MINUTES: ${CACHE_TTL_MINUTES:-5}
       CACHE_SWEEP_INTERVAL_MINUTES: ${CACHE_SWEEP_INTERVAL_MINUTES:-5}
       RATE_LIMIT_WINDOW_MINUTES: ${RATE_LIMIT_WINDOW_MINUTES:-5}

src/services/repo-counter.ts

@@ -132,10 +132,7 @@ export class RepoCounterService {
 
   private validateRequest(request: CountRequest): CountRequest {
     const host = getGitHost(request.repo);
-    if (this.config.allowedGitHosts.length === 0) {
+    if (this.config.allowedGitHosts.length > 0 && !this.config.allowedGitHosts.includes("*") && !this.config.allowedGitHosts.includes(host)) {
-      throw new HttpError(503, "Git hosts are not configured");
-    }
-    if (!this.config.allowedGitHosts.includes("*") && !this.config.allowedGitHosts.includes(host)) {
       throw new HttpError(403, "Git host is not allowed");
     }
     return request;