Push to the in-cluster Forgejo registry over plain HTTP #7

New issue

Closed

opened 2026-09-10 11:38:17 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-10 11:38:17 +00:00

Member

Problem

Pipelines that push large images through build.sh send every layer to git.van-hemmen.com. That hostname resolves to the public ingress (Traefik, on talos-ovh-gateway-one), even though the runners and Forgejo are both in the forgejo namespace, on the same node (talos-ovh-worker-two). Layers therefore leave the node, go through Traefik, and come back.

Traefik's per-request timeout cuts any layer upload that takes longer than about 60 seconds. actions/sindri's coder-xfce-vnc builds have been failing at the push since 2026-09-10 with:

error pushing image: failed to push to destination git.van-hemmen.com/actions/sindri:coder-xfce-vnc-…:
PATCH https://git.van-hemmen.com/v2/actions/sindri/blobs/uploads/…: unexpected status code 502 Bad Gateway

For the same failures, Forgejo logged UploadBlob() [E] unexpected EOF on uploads lasting 60.0–60.7 s.

Proposal

Allow build.sh to push to Forgejo's in-cluster Service (app-http-service.forgejo.svc.cluster.local:3000) over plain HTTP, skipping the ingress. Forgejo already answers the registry API there (/v2/ returns 401 with Docker-Distribution-Api-Version: registry/2.0), and the runner already talks to Forgejo through that Service.

build.sh already supports a custom REGISTRY_HOST, but it has no way to allow a plain-HTTP registry. Add a REGISTRY_INSECURE setting that passes Kaniko's --insecure-registry=${REGISTRY_HOST}. That flag affects only that one registry, so base-image pulls from other registries keep using TLS.

Node-to-node traffic in the cluster goes through WireGuard, so plain HTTP to the Service never crosses the network unencrypted.

🤖 Generated with Claude Code

## Problem Pipelines that push large images through `build.sh` send every layer to `git.van-hemmen.com`. That hostname resolves to the public ingress (Traefik, on `talos-ovh-gateway-one`), even though the runners and Forgejo are both in the `forgejo` namespace, on the same node (`talos-ovh-worker-two`). Layers therefore leave the node, go through Traefik, and come back. Traefik's per-request timeout cuts any layer upload that takes longer than about 60 seconds. `actions/sindri`'s `coder-xfce-vnc` builds have been failing at the push since 2026-09-10 with: ``` error pushing image: failed to push to destination git.van-hemmen.com/actions/sindri:coder-xfce-vnc-…: PATCH https://git.van-hemmen.com/v2/actions/sindri/blobs/uploads/…: unexpected status code 502 Bad Gateway ``` For the same failures, Forgejo logged `UploadBlob() [E] unexpected EOF` on uploads lasting 60.0–60.7 s. ## Proposal Allow `build.sh` to push to Forgejo's in-cluster Service (`app-http-service.forgejo.svc.cluster.local:3000`) over plain HTTP, skipping the ingress. Forgejo already answers the registry API there (`/v2/` returns `401` with `Docker-Distribution-Api-Version: registry/2.0`), and the runner already talks to Forgejo through that Service. `build.sh` already supports a custom `REGISTRY_HOST`, but it has no way to allow a plain-HTTP registry. Add a `REGISTRY_INSECURE` setting that passes Kaniko's `--insecure-registry=${REGISTRY_HOST}`. That flag affects only that one registry, so base-image pulls from other registries keep using TLS. Node-to-node traffic in the cluster goes through WireGuard, so plain HTTP to the Service never crosses the network unencrypted. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot referenced this issue from a commit

2026-09-10 11:38:32 +00:00

#7 - Add REGISTRY_INSECURE to push to an in-cluster registry over plain HTTP

claude-bot referenced this issue from a pull request that will close it,

2026-09-10 11:38:52 +00:00

#7 - Add REGISTRY_INSECURE to push to an in-cluster registry over plain HTTP #8