forgejo_admin/pal-e-platform

Fork 1

fix: route Woodpecker-to-Forgejo API via cluster-internal URL #108

Merged

forgejo_admin merged 1 commit from 107-fix-woodpecker-tls-clone-internal-url into main

2026-03-18 16:41:40 +00:00

forgejo_admin commented

2026-03-18 16:17:44 +00:00

Owner

Summary

Woodpecker server was making all Forgejo API calls through the external Tailscale funnel URL, causing persistent TLS EOF errors on token refresh, PR queries, and repo sync
Switched WOODPECKER_FORGEJO_URL to the cluster-internal Forgejo service and added WOODPECKER_EXPERT_FORGE_OAUTH_HOST to preserve browser OAuth redirects
Removed invalid WOODPECKER_FORGEJO_CLONE_URL env var that was silently ignored by Woodpecker

Changes

terraform/main.tf: Changed WOODPECKER_FORGEJO_URL from https://forgejo.tail5b443a.ts.net to http://forgejo-http.forgejo.svc.cluster.local:80 so all server-side API calls stay cluster-internal
terraform/main.tf: Replaced invalid WOODPECKER_FORGEJO_CLONE_URL with WOODPECKER_EXPERT_FORGE_OAUTH_HOST set to the external URL, preserving browser-facing OAuth login flow
terraform/main.tf: Column-aligned all env var assignments for readability

Test Plan

After apply, run kubectl logs -n woodpecker woodpecker-server-0 and confirm no EOF errors on forgejo.tail5b443a.ts.net API calls
Verify OAuth login still works at https://woodpecker.tail5b443a.ts.net (browser redirect uses external URL via WOODPECKER_EXPERT_FORGE_OAUTH_HOST)
Trigger a pipeline and verify clone step succeeds
Verify repo sync works (Settings > Repos > Sync)

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive
tofu validate passes
tofu fmt clean
tofu plan shows expected 1 resource change (helm_release.woodpecker)

Closes #107
Plan: plan-pal-e-platform

## Summary - Woodpecker server was making all Forgejo API calls through the external Tailscale funnel URL, causing persistent TLS EOF errors on token refresh, PR queries, and repo sync - Switched `WOODPECKER_FORGEJO_URL` to the cluster-internal Forgejo service and added `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` to preserve browser OAuth redirects - Removed invalid `WOODPECKER_FORGEJO_CLONE_URL` env var that was silently ignored by Woodpecker ## Changes - `terraform/main.tf`: Changed `WOODPECKER_FORGEJO_URL` from `https://forgejo.tail5b443a.ts.net` to `http://forgejo-http.forgejo.svc.cluster.local:80` so all server-side API calls stay cluster-internal - `terraform/main.tf`: Replaced invalid `WOODPECKER_FORGEJO_CLONE_URL` with `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` set to the external URL, preserving browser-facing OAuth login flow - `terraform/main.tf`: Column-aligned all env var assignments for readability ## Test Plan - [ ] After apply, run `kubectl logs -n woodpecker woodpecker-server-0` and confirm no EOF errors on `forgejo.tail5b443a.ts.net` API calls - [ ] Verify OAuth login still works at `https://woodpecker.tail5b443a.ts.net` (browser redirect uses external URL via WOODPECKER_EXPERT_FORGE_OAUTH_HOST) - [ ] Trigger a pipeline and verify clone step succeeds - [ ] Verify repo sync works (Settings > Repos > Sync) ## Review Checklist - [x] Passed automated review-fix loop - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive - [x] `tofu validate` passes - [x] `tofu fmt` clean - [x] `tofu plan` shows expected 1 resource change (helm_release.woodpecker) ## Related - Closes #107 - Plan: `plan-pal-e-platform`

forgejo_admin added 1 commit

2026-03-18 16:17:44 +00:00

fix: route Woodpecker-to-Forgejo API calls through cluster-internal URL

ci/woodpecker/push/woodpecker Pipeline failed

Details

ci/woodpecker/pull_request_closed/woodpecker Pipeline failed

Details

0d4b997e78

Woodpecker server was making all Forgejo API calls (token refresh, PR
queries, repo sync) through the external Tailscale funnel URL, causing
persistent TLS EOF errors. The previously-set WOODPECKER_FORGEJO_CLONE_URL
env var is not a valid Woodpecker config option and was silently ignored.

Changes:
- WOODPECKER_FORGEJO_URL: external funnel -> cluster-internal service
  (http://forgejo-http.forgejo.svc.cluster.local:80)
- Replace invalid WOODPECKER_FORGEJO_CLONE_URL with
  WOODPECKER_EXPERT_FORGE_OAUTH_HOST pointed at the external URL,
  preserving browser OAuth redirects
- Column-align all env var assignments for readability

This eliminates the Tailscale funnel as a bottleneck for all server-side
API traffic. Clone steps still fetch from the external URL (Forgejo API
reports clone URLs based on ROOT_URL), but the clone plugin has built-in
retry logic (5 attempts with 5s backoff).

Closes #107

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

forgejo_admin commented

2026-03-18 16:18:15 +00:00

Author

Owner

Review

Result: PASS -- no issues found.

Verified

WOODPECKER_FORGEJO_URL correctly points to cluster-internal Forgejo service (http://forgejo-http.forgejo.svc.cluster.local:80), matching the URL already used by the blackbox exporter and DORA exporter in this same file
WOODPECKER_EXPERT_FORGE_OAUTH_HOST is a documented Woodpecker env var (maps to forge.OAuthHost -> forgejo.Opts.OAuth2URL), confirmed in Woodpecker v3 source code
Removed WOODPECKER_FORGEJO_CLONE_URL is confirmed invalid -- not present in Woodpecker CLI flags, source code, or documentation
No secrets exposed, no unnecessary file changes
tofu validate passes, tofu fmt clean

Scope note

Clone steps will still fetch from the external Tailscale funnel URL (Forgejo reports clone URLs based on its ROOT_URL). The clone plugin has built-in retry (5 attempts, 5s backoff). If clone TLS failures persist after this fix, a follow-up issue could explore CoreDNS rewrite or a custom clone step override.

## Review **Result: PASS** -- no issues found. ### Verified - `WOODPECKER_FORGEJO_URL` correctly points to cluster-internal Forgejo service (`http://forgejo-http.forgejo.svc.cluster.local:80`), matching the URL already used by the blackbox exporter and DORA exporter in this same file - `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` is a documented Woodpecker env var (maps to `forge.OAuthHost` -> `forgejo.Opts.OAuth2URL`), confirmed in Woodpecker v3 source code - Removed `WOODPECKER_FORGEJO_CLONE_URL` is confirmed invalid -- not present in Woodpecker CLI flags, source code, or documentation - No secrets exposed, no unnecessary file changes - `tofu validate` passes, `tofu fmt` clean ### Scope note Clone steps will still fetch from the external Tailscale funnel URL (Forgejo reports clone URLs based on its `ROOT_URL`). The clone plugin has built-in retry (5 attempts, 5s backoff). If clone TLS failures persist after this fix, a follow-up issue could explore CoreDNS rewrite or a custom clone step override.

forgejo_admin commented

2026-03-18 16:37:52 +00:00

Author

Owner

PR #108 Review

DOMAIN REVIEW

Tech stack: Terraform / Helm values (Woodpecker CI Helm chart v3.5.1)

Internal service URL validation: The new WOODPECKER_FORGEJO_URL value http://forgejo-http.forgejo.svc.cluster.local:80 is correct. This matches:

The Forgejo ingress backend service name (forgejo-http in namespace forgejo, port 80) defined at line 679 of terraform/main.tf
The identical URL pattern used by the DORA exporter ConfigMap (line 1147)
The blackbox probe target (line 410)
Four other *.svc.cluster.local references in the same file following the same {service}.{namespace}.svc.cluster.local:{port} convention

OAuth host separation: WOODPECKER_EXPERT_FORGE_OAUTH_HOST is the correct Woodpecker env var for overriding the browser-facing OAuth redirect host when the server-side API URL differs. Setting it to https://forgejo.${var.tailscale_domain} preserves the external OAuth login flow while routing all server-side API calls (token refresh, PR status, repo sync) through the cluster network.

WOODPECKER_FORGEJO_CLONE_URL removal: This env var is not a recognized Woodpecker server configuration option. It was silently ignored. Removing it eliminates dead config. Woodpecker's clone step in pipeline containers uses WOODPECKER_FORGEJO_URL (now pointing to the internal service), which is correct because pipeline pods also run inside the cluster.

Secrets handling: No new secrets introduced. Existing WOODPECKER_FORGEJO_CLIENT, WOODPECKER_FORGEJO_SECRET, and WOODPECKER_AGENT_SECRET remain properly handled via set_sensitive blocks (lines 760-774). No credentials in the diff.

Column alignment: The whitespace changes (re-aligning = signs) are consistent and improve readability. No functional impact.

BLOCKERS

None.

No new functionality requiring tests (this is a Helm values configuration fix)
No user input introduced
No secrets or credentials in the diff
No auth/security DRY violations

NITS

None. The change is minimal, focused, and correct.

SOP COMPLIANCE

Branch named after issue (107-fix-woodpecker-tls-clone-internal-url)
PR body has Summary, Changes, Test Plan, Related
Related references plan-pal-e-platform and closes #107
No secrets committed
No unnecessary file changes (1 file, 7 additions / 7 deletions)
Commit message is descriptive
tofu validate and tofu fmt confirmed in checklist

PROCESS OBSERVATIONS

Change failure risk: Low. The internal service URL is already validated by four other consumers in the same file. The env var change is a pure routing fix with no schema or API changes.
MTTR impact: Positive. Eliminating TLS EOF errors on the Forgejo API path removes a recurring failure mode for CI pipelines, improving both deployment frequency and mean time to recovery.
Test plan adequacy: The manual test plan covers the four critical paths (logs, OAuth, pipeline, repo sync). For an infrastructure config change with no testable code, this is appropriate.

VERDICT: APPROVED

## PR #108 Review ### DOMAIN REVIEW **Tech stack**: Terraform / Helm values (Woodpecker CI Helm chart v3.5.1) **Internal service URL validation**: The new `WOODPECKER_FORGEJO_URL` value `http://forgejo-http.forgejo.svc.cluster.local:80` is correct. This matches: - The Forgejo ingress backend service name (`forgejo-http` in namespace `forgejo`, port 80) defined at line 679 of `terraform/main.tf` - The identical URL pattern used by the DORA exporter ConfigMap (line 1147) - The blackbox probe target (line 410) - Four other `*.svc.cluster.local` references in the same file following the same `{service}.{namespace}.svc.cluster.local:{port}` convention **OAuth host separation**: `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` is the correct Woodpecker env var for overriding the browser-facing OAuth redirect host when the server-side API URL differs. Setting it to `https://forgejo.${var.tailscale_domain}` preserves the external OAuth login flow while routing all server-side API calls (token refresh, PR status, repo sync) through the cluster network. **WOODPECKER_FORGEJO_CLONE_URL removal**: This env var is not a recognized Woodpecker server configuration option. It was silently ignored. Removing it eliminates dead config. Woodpecker's clone step in pipeline containers uses `WOODPECKER_FORGEJO_URL` (now pointing to the internal service), which is correct because pipeline pods also run inside the cluster. **Secrets handling**: No new secrets introduced. Existing `WOODPECKER_FORGEJO_CLIENT`, `WOODPECKER_FORGEJO_SECRET`, and `WOODPECKER_AGENT_SECRET` remain properly handled via `set_sensitive` blocks (lines 760-774). No credentials in the diff. **Column alignment**: The whitespace changes (re-aligning `=` signs) are consistent and improve readability. No functional impact. ### BLOCKERS None. - No new functionality requiring tests (this is a Helm values configuration fix) - No user input introduced - No secrets or credentials in the diff - No auth/security DRY violations ### NITS None. The change is minimal, focused, and correct. ### SOP COMPLIANCE - [x] Branch named after issue (`107-fix-woodpecker-tls-clone-internal-url`) - [x] PR body has Summary, Changes, Test Plan, Related - [x] Related references `plan-pal-e-platform` and closes #107 - [x] No secrets committed - [x] No unnecessary file changes (1 file, 7 additions / 7 deletions) - [x] Commit message is descriptive - [x] `tofu validate` and `tofu fmt` confirmed in checklist ### PROCESS OBSERVATIONS - **Change failure risk**: Low. The internal service URL is already validated by four other consumers in the same file. The env var change is a pure routing fix with no schema or API changes. - **MTTR impact**: Positive. Eliminating TLS EOF errors on the Forgejo API path removes a recurring failure mode for CI pipelines, improving both deployment frequency and mean time to recovery. - **Test plan adequacy**: The manual test plan covers the four critical paths (logs, OAuth, pipeline, repo sync). For an infrastructure config change with no testable code, this is appropriate. ### VERDICT: APPROVED