fix: allow any HTTPS host for dotfiles repo

Self-hosted GitLab, Gitea, etc. are valid. Only require HTTPS +
valid path format, not a specific host allowlist.

Author: fullstackjam

src/lib/server/validation.test.ts

@@ -141,11 +141,10 @@ describe('validateDotfilesRepo', () => {
 		expect(result.error).toContain('too long');
 	});
 
-	it('should reject disallowed hosts', () => {
-		const result = validateDotfilesRepo('https://example.com/user/dotfiles.git');
+	it('should accept any HTTPS host including self-hosted', () => {
+		const result = validateDotfilesRepo('https://gitlab.huami.com/user/dotfiles.git');
 
-		expect(result.valid).toBe(false);
-		expect(result.error).toContain('GitHub, GitLab, Bitbucket, or Codeberg');
+		expect(result.valid).toBe(true);
 	});
 
 

src/lib/server/validation.ts

@@ -49,14 +49,8 @@ export function validateDotfilesRepo(url: string | null | undefined): Validation
 		const parsed = new URL(url);
 		const hostname = parsed.hostname.toLowerCase();
 
-		const allowedHosts = ['github.com', 'gitlab.com', 'bitbucket.org', 'codeberg.org'];
-		const isAllowed = allowedHosts.includes(hostname);
-
-		if (!isAllowed) {
-			return {
-				valid: false,
-				error: 'Dotfiles repo must be hosted on GitHub, GitLab, Bitbucket, or Codeberg'
-			};
+		if (!hostname) {
+			return { valid: false, error: 'Dotfiles repo URL is missing a hostname' };
 		}
 
 		if (parsed.pathname.includes('..') || parsed.pathname.includes('//')) {