@whitequark possibly relevant: on the webhook page, under Recent Deliveries, I clicked on one (they are apparently all the same), and it has a 401 response with this body:
unauthorized
- missing Authorization header
- failed to look up DNS repository allowlist: _git-pages-repository.sub1.swiss-soccer.net TXT
- domain sub1.swiss-soccer.net does not match wildcard *.grebedoc.dev
even though there is a CNAME with host sub1 and value grebedoc.dev. with ., and a TXT record with host _git-pages-repository.sub1.swiss-soccer.net and value https://codeberg.org/nxskok/sub1.git *and* per dig it seems to have propagated.