From c745723e82a02bca831b14cad25dfc4a6c41982d Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Mon, 13 Jul 2026 01:46:31 +0200 Subject: [PATCH] fix(gitea): BUILTIN_SSH_SERVER_USER=gitea so gitea@ remotes authenticate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #159 set SSH_USER=gitea, but SSH_USER is cosmetic (clone-URL display only) and does not change which login the built-in SSH server accepts — so gitea@ still got Permission denied. BUILTIN_SSH_SERVER_USER is the setting the built-in server checks the login name against (defaults to RUN_USER=git); pin it to gitea so the existing gitea@ remotes (the LXC's non-default SSH user) authenticate with zero client changes. git@ stops authenticating (single built-in login) — unused here. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01HQhvu1mrQ7EgwLhrzdNyY7 --- kubernetes/apps/gitea/statefulset.yaml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/kubernetes/apps/gitea/statefulset.yaml b/kubernetes/apps/gitea/statefulset.yaml index 06634a2f..bbdeabc0 100644 --- a/kubernetes/apps/gitea/statefulset.yaml +++ b/kubernetes/apps/gitea/statefulset.yaml @@ -62,10 +62,18 @@ spec: value: "22" - name: GITEA__server__SSH_DOMAIN value: gitea.renner.uno - # The LXC ran as RUN_USER=gitea, so every existing remote and clone - # URL is gitea@gitea.renner.uno. The rootless image runs as `git`, so - # SSH_USER would default to `git` and reject `gitea@` logins. Pin it to - # `gitea` so existing remotes keep working with no client changes. + # The LXC ran RUN_USER=gitea, so every existing remote/clone URL is + # gitea@gitea.renner.uno. The rootless image runs as `git`, so the + # built-in SSH server would only accept `git@` and reject `gitea@`. + # BUILTIN_SSH_SERVER_USER is what the built-in server checks the login + # name against (defaults to RUN_USER=git) -> set it to `gitea` so + # gitea@ authenticates. SSH_USER only sets the DISPLAYED clone URL (it + # does NOT affect auth) -> also gitea so the UI matches. This keeps all + # existing gitea@ remotes working with no client changes. Trade-off: + # git@ no longer authenticates (single built-in login), which is fine — + # nothing here uses git@. + - name: GITEA__server__BUILTIN_SSH_SERVER_USER + value: gitea - name: GITEA__server__SSH_USER value: gitea - name: GITEA__server__DISABLE_SSH -- 2.54.0