On Tue, May 26, 2026 at 1:44 PM Vasco Schiavo ***@***.***> wrote: ***@***.**** approved this pull request. Just a small comment. Otherwise, LGTM ------------------------------ In openhands/usage/environment-variables.mdx <#521 (comment)>: > @@ -166,6 +166,21 @@ These variables correspond to the `[security]` section in `config.toml`: ## Integration Variables +### Git Provider Access +| Environment Variable | Type | Default | Description | +|---------------------|------|---------|-------------| +| `ALLOW_INSECURE_GIT_ACCESS` | boolean | `false` | Allow OpenHands to connect to git providers over plain HTTP. Set this only for trusted local or internal Gitea/Forgejo instances where HTTPS is not available. | The wording is slightly narrower than the actual code behavior. In provider.py, the insecure-HTTP path triggers for any provider whose host starts with http:// (e.g. a self-hosted GitLab over plain HTTP) if domain and domain.strip().startswith('http://'): allow_insecure = os.environ.get('ALLOW_INSECURE_GIT_ACCESS', 'false').lower() in ('true', '1', 'yes') Could we generalize the description slightly, e.g.: Allow OpenHands to connect to git providers over plain HTTP. Set this only for trusted local or internal git providers (such as Gitea/Forgejo) where HTTPS is not available. — Reply to this email directly, view it on GitHub <#521?email_source=notifications&email_token=APOFE6WWOLAUMGS6CR56TFD44VG4VA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMZWGE4DKMBYGAYKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#pullrequestreview-4361850800>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APOFE6T6NGLZ5IDTFN7O6OL44VG4VAVCNFSM6AAAAACZMPYT7KVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DGNRRHA2TAOBQGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>