[GH-ISSUE #171] Mirroring fails but reports success #1957

New Issue

2026-05-03T02:52:23-05:00

GiteaMirror commented

2026-05-03 02:52:23 -05:00

Originally created by @tylerobara on GitHub (Jan 26, 2026).
Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/171

I set this up last week and it successfully brought in all of my Github repos. For 3 days, and on each manual sync, Gitea Mirror reports it successfully synced but there are errors in Forgejo logs

2026/01/26 20:28:45 ...irror/mirror_pull.go:338:runSync() [E] SyncMirrors [repo: <Repository 20:tylerobara/example>]: failed to update mirror repository:
 Stderr: fatal: could not read Password for 'https://sanitized-credential@github.com': terminal prompts disabled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Err: exit status 128                                                                                                                                                                                                                                                                                                                                                                                                   2026/01/26 20:28:46 ...c/net/http/server.go:2322:ServeHTTP() [I] PING DATABASE postgresschema                                                                                                                                                                                                                                                                                                                          2026/01/26 20:28:46 .

Note the log line https://sanitized-credential@github.com was not sanitized by me. Exactly how it appears. If I Test credentials for Github and Forgejo, both report successful.

Originally created by @tylerobara on GitHub (Jan 26, 2026). Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/171 I set this up last week and it successfully brought in all of my Github repos. For 3 days, and on each manual sync, Gitea Mirror reports it successfully synced but there are errors in Forgejo logs ``` 2026/01/26 20:28:45 ...irror/mirror_pull.go:338:runSync() [E] SyncMirrors [repo: <Repository 20:tylerobara/example>]: failed to update mirror repository: Stderr: fatal: could not read Password for 'https://sanitized-credential@github.com': terminal prompts disabled Err: exit status 128 2026/01/26 20:28:46 ...c/net/http/server.go:2322:ServeHTTP() [I] PING DATABASE postgresschema 2026/01/26 20:28:46 . ``` Note the log line `https://sanitized-credential@github.com` was not sanitized by me. Exactly how it appears. If I Test credentials for Github and Forgejo, both report successful.

GiteaMirror closed this issue

2026-05-03 02:52:24 -05:00

GiteaMirror commented

2026-05-03 02:52:25 -05:00

@arunavo4 commented on GitHub (Jan 27, 2026):

@tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

@arunavo4 commented on GitHub (Jan 27, 2026): @tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

GiteaMirror commented

2026-05-03 02:52:26 -05:00

@tylerobara commented on GitHub (Jan 27, 2026):

@tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

I am deploying with this helm chart and these values:

gitea-mirror:
  defaultPodOptions:
    securityContext:
      fsGroup: 1001

  controllers:
    gitea-mirror:
      strategy: Recreate
      containers:
        main:
          image:
            repository: ghcr.io/raylabshq/gitea-mirror
            tag: '2496d6f'
            pullPolicy: IfNotPresent
          env:
            BETTER_AUTH_URL: "https://forgejo-mirror.example.com"
            ENCRYPTION_SECRET:
              valueFrom:
                secretKeyRef:
                  name: gitea-mirror-secrets
                  key: ENCRYPTION_SECRET
            BETTER_AUTH_SECRET:
              valueFrom:
                secretKeyRef:
                  name: gitea-mirror-secrets
                  key: BETTER_AUTH_SECRET
  service:
    gitea-mirror:
      controller: gitea-mirror
      ports:
        http:
          port: 4321

  ingress:
    gitea-mirror:
      annotations: 
        kubernetes.io/ingress.class: traefik
        gethomepage.dev/href: "https://forgejo-mirror.example.com"
        gethomepage.dev/enabled: "true"
        gethomepage.dev/name: "Forgejo Mirror"
        gethomepage.dev/description: "Code Sharing"
        gethomepage.dev/group: "Development"
        gethomepage.dev/icon: "sh-gitea-mirror.png"
        traefik.ingress.kubernetes.io/router.middlewares: traefik-traefik-oidc-auth@kubernetescrd
      className: "traefik"
      hosts:
        - host: forgejo-mirror.example.com
          paths:
            - path: /
              pathType: Prefix
              service:
                identifier: gitea-mirror
                port: http

  persistence:
    data:
      type: persistentVolumeClaim
      accessMode: ReadWriteOnce
      size: 300Mi
      globalMounts:
        - path: /app/data

externalSecrets:
  secretStoreRef:
    name: cluster-secret-store
    kind: ClusterSecretStore
  target:
    name: gitea-mirror-secrets
  data:
  - secretKey: ENCRYPTION_SECRET
    remoteRef:
      key: development/gitea-mirror
      property: ENCRYPTION_SECRET
  - secretKey: BETTER_AUTH_SECRET
    remoteRef:
      key: development/gitea-mirror
      property: BETTER_AUTH_SECRET

@tylerobara commented on GitHub (Jan 27, 2026): > [@tylerobara](https://github.com/tylerobara) need to take a look at this. can you clean up your docker compse and post of you have any unique setup? I am deploying with [this](https://bjw-s-labs.github.io/helm-charts/docs/app-template/) helm chart and these values: ```yaml gitea-mirror: defaultPodOptions: securityContext: fsGroup: 1001 controllers: gitea-mirror: strategy: Recreate containers: main: image: repository: ghcr.io/raylabshq/gitea-mirror tag: '2496d6f' pullPolicy: IfNotPresent env: BETTER_AUTH_URL: "https://forgejo-mirror.example.com" ENCRYPTION_SECRET: valueFrom: secretKeyRef: name: gitea-mirror-secrets key: ENCRYPTION_SECRET BETTER_AUTH_SECRET: valueFrom: secretKeyRef: name: gitea-mirror-secrets key: BETTER_AUTH_SECRET service: gitea-mirror: controller: gitea-mirror ports: http: port: 4321 ingress: gitea-mirror: annotations: kubernetes.io/ingress.class: traefik gethomepage.dev/href: "https://forgejo-mirror.example.com" gethomepage.dev/enabled: "true" gethomepage.dev/name: "Forgejo Mirror" gethomepage.dev/description: "Code Sharing" gethomepage.dev/group: "Development" gethomepage.dev/icon: "sh-gitea-mirror.png" traefik.ingress.kubernetes.io/router.middlewares: traefik-traefik-oidc-auth@kubernetescrd className: "traefik" hosts: - host: forgejo-mirror.example.com paths: - path: / pathType: Prefix service: identifier: gitea-mirror port: http persistence: data: type: persistentVolumeClaim accessMode: ReadWriteOnce size: 300Mi globalMounts: - path: /app/data externalSecrets: secretStoreRef: name: cluster-secret-store kind: ClusterSecretStore target: name: gitea-mirror-secrets data: - secretKey: ENCRYPTION_SECRET remoteRef: key: development/gitea-mirror property: ENCRYPTION_SECRET - secretKey: BETTER_AUTH_SECRET remoteRef: key: development/gitea-mirror property: BETTER_AUTH_SECRET ```

GiteaMirror commented

2026-05-03 02:52:27 -05:00

@tylerobara commented on GitHub (Jan 29, 2026):

Update: I put a fake Github token and hit test, then put my valid token back in and hit test again. It says connected successsfully but I get the same error on sync in the Forgejo logs. But.... if I update the password field in a repo > settings > mirror settings > authorization > password with the same token, the mirror syncs no problem.

@tylerobara commented on GitHub (Jan 29, 2026): Update: I put a fake Github token and hit test, then put my valid token back in and hit test again. It says connected successsfully but I get the same error on sync in the Forgejo logs. But.... if I update the password field in a repo > settings > mirror settings > authorization > password with the same token, the mirror syncs no problem.

GiteaMirror commented

2026-05-03 02:52:28 -05:00

@arunavo4 commented on GitHub (Feb 24, 2026):

Good catch, and thanks for the detailed report.

I dug into this and the behavior lines up with how Gitea/Forgejo handles pull mirrors:

The mirror-sync API call only queues a sync request and returns 200.
The actual pull happens later in Forgejo/Gitea, so it can still fail in server logs after that.
For existing mirrors, changing the GitHub token in Gitea Mirror does not always update the saved mirror credentials on the Forgejo side.

I opened #181 to improve this from our side:

we now show "Sync requested" instead of implying the sync fully succeeded
added README troubleshooting for token rotation on existing mirror repos

For repos already affected right now, the immediate fix is still:

update token in Forgejo repo Settings -> Mirror Settings, or
delete and re-mirror from Gitea Mirror so it is recreated with current credentials.

@arunavo4 commented on GitHub (Feb 24, 2026): Good catch, and thanks for the detailed report. I dug into this and the behavior lines up with how Gitea/Forgejo handles pull mirrors: 1) The mirror-sync API call only queues a sync request and returns 200. 2) The actual pull happens later in Forgejo/Gitea, so it can still fail in server logs after that. 3) For existing mirrors, changing the GitHub token in Gitea Mirror does not always update the saved mirror credentials on the Forgejo side. I opened #181 to improve this from our side: - we now show "Sync requested" instead of implying the sync fully succeeded - added README troubleshooting for token rotation on existing mirror repos For repos already affected right now, the immediate fix is still: - update token in Forgejo repo Settings -> Mirror Settings, or - delete and re-mirror from Gitea Mirror so it is recreated with current credentials.

GiteaMirror commented

2026-05-03 02:52:28 -05:00

@arunavo4 commented on GitHub (Feb 24, 2026):

Resolved by #181: sync status wording is now accurate for async mirror pulls, and README now documents token-rotation behavior/workarounds for existing mirrors.

@arunavo4 commented on GitHub (Feb 24, 2026): Resolved by #181: sync status wording is now accurate for async mirror pulls, and README now documents token-rotation behavior/workarounds for existing mirrors.

GiteaMirror commented

2026-05-03 02:52:29 -05:00

@pedorich-n commented on GitHub (Mar 2, 2026):

I also found these "terminal prompts disabled" notices in my Forgejo instance. I tried re-creating the repos, but the notices always came back. After some searching, I found that this is actually an issue with Forgejo: https://codeberg.org/forgejo/forgejo/issues/9629.

@pedorich-n commented on GitHub (Mar 2, 2026): I also found these "terminal prompts disabled" notices in my Forgejo instance. I tried re-creating the repos, but the notices always came back. After some searching, I found that this is actually an issue with Forgejo: https://codeberg.org/forgejo/forgejo/issues/9629.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea-mirror#1957