List of IPs that renovate runs on for VPN access

[ahatzz11]

👋 This is related to #16188, but I thought I would make a separate discussion with a smaller scope to hopefully facilitate some extra conversation.

We are using the Renovate Github App and trying to configure a private nexus repository that sits behind our internal VPN. We are able to add certain IPs to an allowList though, so I'm just curious if we are able to get the list of IPs that a request from renovate can originate from? I think we could self-host to fix this issue, but if we could keep with the hosted option that would be awesome.

The result would be something similar to how github exposes the IP addresses for dependabot, and via the meta api call: https://api.github.com/meta.

[rarkins]

We don't currently have a fixed set of IP addresses for the hosted app. The list is ephemeral and changing too quickly to be useful

[dkhaye]

We added the above IPs to our whitelist, but now about 1 in 4 of our Renovate runs fails with "...your IP address is not permitted to access this resource". I suspect there was an additional host(s?) added recently. Can you share the new IPs?

[rarkins]

Hi, please try adding 35.169.49.18

[iwata]

@rarkins We have added the IP addresses mentioned here to our whitelist, but we seem to be frequently accessed from different addresses these days. Have new IPs been added?

[rarkins]

More IP's have been added, but the list should be stabilized for around 1-2 years now.

The current list is:

    "35.169.49.18",
    "52.207.155.173",
    "52.0.106.131",
    "34.197.147.244",
    "54.243.119.210",
    "98.82.39.166",
    "107.20.215.6",
    "44.206.201.73",
    "34.239.12.110",
    "52.45.235.219",
    "52.31.29.228",
    "34.239.12.110"

You can also programmatically follow the "developer-platform" section of https://mend-resources.mend.io/ip.json

[iwata]

Thanks!