Renovate strange POST IPs

[GuillaumeHemmen]

What would you like help with?

Other

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

gitlab self hosted and renovate through docker version 37.438.2

Please tell us more about your question or problem

Hello,

I am reaching out for assistance after being unsuccessful in finding a solution to an issue I'm encountering.

I am attempting to add Renovate to my project, a project hosted on my company's self-hosted GitLab. This GitLab instance is hosted on AWS and protected by a WAF, making it accessible only to whitelisted IP addresses (the office and our SaaS CI/CD).

During the implementation of Renovate, I had the option to use either npx renovate or Docker. While npx renovate worked fine locally, it failed on our CI/CD due to an outdated version of Git on the Ubuntu 20 LTS base image. Since I have no control over the base image, I opted to run Renovate via Docker to avoid dependency issues.

On paper, everything seems to be running smoothly. However, I encountered an issue with the step "WARN: Could not ensure issue." The debug logs show that all GET API calls are successful, whether run locally or from the CI/CD, and they are recognized as originating from a whitelisted IP. The problem arises with the only API POST call, which fails because our WAF identifies it as coming from an unknown US IP address that is not whitelisted. It's as if there's a MitM (Man-in-the-Middle) situation or something similar.

Would you have any insights into why all GET calls are working but not the POST call? I am completely clueless as to the cause of this discrepancy.

Thank you for your assistance.

Logs (if relevant)

Logs

Due to the log being too long, see https://bin.van-hemmen.com/?55684cbd66728e10#5jA5RjaFh6T5SbW5BGaFxxP1eZLUSLd5XDaG5kFQLnMt

[rarkins]

GET and POST should be sent from the same IP (the IP of the container you're running). If someone were to MitM you or this project I'm not sure why they'd do it only for POST because credentials are sent for all requests. The Renovate CLI does not send requests like this via Mend or any other third parties and is used "airgapped" by some users.

[GuillaumeHemmen]

Hello @rarkins, thanks a lot for the feedback, just to confirm, I forgot to add the IP in my original message. Do you confirm that these are unkown to Mend?

3.235.3.164
54.198.16.59
52.37.58.40
35.161.230.174

[rarkins]

I do not confirm any IP's at all, my last answer is conclusive

[GuillaumeHemmen]

Thanks a lot @rarkins. If you allow it I will keep the conversation open to give a feedback once i have the root cause of my problem to help anyone with the same problem! :)

[rarkins]

Sure. To clarify:

• You're running the OSS Renovate, the source code all in this repo, it does not "phone home"
• Those IP's aren't part of the Mend Renovate app, but I do not have the time or niterest to find out every IP address ever used by Mend to answer the question you asked

[GuillaumeHemmen]

Hello, some clarification for those who might stumble around this thread: renovate was at no point responsible of my issue. It was a problem of config with hosted gitlab of my company for which i cannot provide details (I do not have control of view of this part).