[GH-ISSUE #171] Mirroring fails but reports success

kerem commented

2026-02-27 15:55:02 +03:00

Owner

Originally created by @tylerobara on GitHub (Jan 26, 2026).
Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/171

I set this up last week and it successfully brought in all of my Github repos. For 3 days, and on each manual sync, Gitea Mirror reports it successfully synced but there are errors in Forgejo logs

2026/01/26 20:28:45 ...irror/mirror_pull.go:338:runSync() [E] SyncMirrors [repo: <Repository 20:tylerobara/example>]: failed to update mirror repository:
 Stderr: fatal: could not read Password for 'https://sanitized-credential@github.com': terminal prompts disabled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Err: exit status 128                                                                                                                                                                                                                                                                                                                                                                                                   2026/01/26 20:28:46 ...c/net/http/server.go:2322:ServeHTTP() [I] PING DATABASE postgresschema                                                                                                                                                                                                                                                                                                                          2026/01/26 20:28:46 .

Note the log line https://sanitized-credential@github.com was not sanitized by me. Exactly how it appears. If I Test credentials for Github and Forgejo, both report successful.

Originally created by @tylerobara on GitHub (Jan 26, 2026). Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/171 I set this up last week and it successfully brought in all of my Github repos. For 3 days, and on each manual sync, Gitea Mirror reports it successfully synced but there are errors in Forgejo logs ``` 2026/01/26 20:28:45 ...irror/mirror_pull.go:338:runSync() [E] SyncMirrors [repo: <Repository 20:tylerobara/example>]: failed to update mirror repository: Stderr: fatal: could not read Password for 'https://sanitized-credential@github.com': terminal prompts disabled Err: exit status 128 2026/01/26 20:28:46 ...c/net/http/server.go:2322:ServeHTTP() [I] PING DATABASE postgresschema 2026/01/26 20:28:46 . ``` Note the log line `https://sanitized-credential@github.com` was not sanitized by me. Exactly how it appears. If I Test credentials for Github and Forgejo, both report successful.

kerem closed this issue

2026-02-27 15:55:03 +03:00

kerem commented

2026-02-27 15:55:03 +03:00

Author

Owner

@arunavo4 commented on GitHub (Jan 27, 2026):

@tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

@arunavo4 commented on GitHub (Jan 27, 2026): @tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

kerem commented

2026-02-27 15:55:03 +03:00

Author

Owner

@tylerobara commented on GitHub (Jan 27, 2026):

@tylerobara need to take a look at this. can you clean up your docker compse and post of you have any unique setup?

I am deploying with this helm chart and these values:

gitea-mirror:
  defaultPodOptions:
    securityContext:
      fsGroup: 1001

  controllers:
    gitea-mirror:
      strategy: Recreate
      containers:
        main:
          image:
            repository: ghcr.io/raylabshq/gitea-mirror
            tag: '2496d6f'
            pullPolicy: IfNotPresent
          env:
            BETTER_AUTH_URL: "https://forgejo-mirror.example.com"
            ENCRYPTION_SECRET:
              valueFrom:
                secretKeyRef:
                  name: gitea-mirror-secrets
                  key: ENCRYPTION_SECRET
            BETTER_AUTH_SECRET:
              valueFrom:
                secretKeyRef:
                  name: gitea-mirror-secrets
                  key: BETTER_AUTH_SECRET
  service:
    gitea-mirror:
      controller: gitea-mirror
      ports:
        http:
          port: 4321

  ingress:
    gitea-mirror:
      annotations: 
        kubernetes.io/ingress.class: traefik
        gethomepage.dev/href: "https://forgejo-mirror.example.com"
        gethomepage.dev/enabled: "true"
        gethomepage.dev/name: "Forgejo Mirror"
        gethomepage.dev/description: "Code Sharing"
        gethomepage.dev/group: "Development"
        gethomepage.dev/icon: "sh-gitea-mirror.png"
        traefik.ingress.kubernetes.io/router.middlewares: traefik-traefik-oidc-auth@kubernetescrd
      className: "traefik"
      hosts:
        - host: forgejo-mirror.example.com
          paths:
            - path: /
              pathType: Prefix
              service:
                identifier: gitea-mirror
                port: http

  persistence:
    data:
      type: persistentVolumeClaim
      accessMode: ReadWriteOnce
      size: 300Mi
      globalMounts:
        - path: /app/data

externalSecrets:
  secretStoreRef:
    name: cluster-secret-store
    kind: ClusterSecretStore
  target:
    name: gitea-mirror-secrets
  data:
  - secretKey: ENCRYPTION_SECRET
    remoteRef:
      key: development/gitea-mirror
      property: ENCRYPTION_SECRET
  - secretKey: BETTER_AUTH_SECRET
    remoteRef:
      key: development/gitea-mirror
      property: BETTER_AUTH_SECRET

@tylerobara commented on GitHub (Jan 27, 2026): > [@tylerobara](https://github.com/tylerobara) need to take a look at this. can you clean up your docker compse and post of you have any unique setup? I am deploying with [this](https://bjw-s-labs.github.io/helm-charts/docs/app-template/) helm chart and these values: ```yaml gitea-mirror: defaultPodOptions: securityContext: fsGroup: 1001 controllers: gitea-mirror: strategy: Recreate containers: main: image: repository: ghcr.io/raylabshq/gitea-mirror tag: '2496d6f' pullPolicy: IfNotPresent env: BETTER_AUTH_URL: "https://forgejo-mirror.example.com" ENCRYPTION_SECRET: valueFrom: secretKeyRef: name: gitea-mirror-secrets key: ENCRYPTION_SECRET BETTER_AUTH_SECRET: valueFrom: secretKeyRef: name: gitea-mirror-secrets key: BETTER_AUTH_SECRET service: gitea-mirror: controller: gitea-mirror ports: http: port: 4321 ingress: gitea-mirror: annotations: kubernetes.io/ingress.class: traefik gethomepage.dev/href: "https://forgejo-mirror.example.com" gethomepage.dev/enabled: "true" gethomepage.dev/name: "Forgejo Mirror" gethomepage.dev/description: "Code Sharing" gethomepage.dev/group: "Development" gethomepage.dev/icon: "sh-gitea-mirror.png" traefik.ingress.kubernetes.io/router.middlewares: traefik-traefik-oidc-auth@kubernetescrd className: "traefik" hosts: - host: forgejo-mirror.example.com paths: - path: / pathType: Prefix service: identifier: gitea-mirror port: http persistence: data: type: persistentVolumeClaim accessMode: ReadWriteOnce size: 300Mi globalMounts: - path: /app/data externalSecrets: secretStoreRef: name: cluster-secret-store kind: ClusterSecretStore target: name: gitea-mirror-secrets data: - secretKey: ENCRYPTION_SECRET remoteRef: key: development/gitea-mirror property: ENCRYPTION_SECRET - secretKey: BETTER_AUTH_SECRET remoteRef: key: development/gitea-mirror property: BETTER_AUTH_SECRET ```

kerem commented

2026-02-27 15:55:03 +03:00

Author

Owner

@tylerobara commented on GitHub (Jan 29, 2026):

Update: I put a fake Github token and hit test, then put my valid token back in and hit test again. It says connected successsfully but I get the same error on sync in the Forgejo logs. But.... if I update the password field in a repo > settings > mirror settings > authorization > password with the same token, the mirror syncs no problem.

@tylerobara commented on GitHub (Jan 29, 2026): Update: I put a fake Github token and hit test, then put my valid token back in and hit test again. It says connected successsfully but I get the same error on sync in the Forgejo logs. But.... if I update the password field in a repo > settings > mirror settings > authorization > password with the same token, the mirror syncs no problem.

kerem commented

2026-02-27 15:55:03 +03:00

Author

Owner

@arunavo4 commented on GitHub (Feb 24, 2026):

Good catch, and thanks for the detailed report.

I dug into this and the behavior lines up with how Gitea/Forgejo handles pull mirrors:

The mirror-sync API call only queues a sync request and returns 200.
The actual pull happens later in Forgejo/Gitea, so it can still fail in server logs after that.
For existing mirrors, changing the GitHub token in Gitea Mirror does not always update the saved mirror credentials on the Forgejo side.

I opened #181 to improve this from our side:

we now show "Sync requested" instead of implying the sync fully succeeded
added README troubleshooting for token rotation on existing mirror repos

For repos already affected right now, the immediate fix is still:

update token in Forgejo repo Settings -> Mirror Settings, or
delete and re-mirror from Gitea Mirror so it is recreated with current credentials.

@arunavo4 commented on GitHub (Feb 24, 2026): Good catch, and thanks for the detailed report. I dug into this and the behavior lines up with how Gitea/Forgejo handles pull mirrors: 1) The mirror-sync API call only queues a sync request and returns 200. 2) The actual pull happens later in Forgejo/Gitea, so it can still fail in server logs after that. 3) For existing mirrors, changing the GitHub token in Gitea Mirror does not always update the saved mirror credentials on the Forgejo side. I opened #181 to improve this from our side: - we now show "Sync requested" instead of implying the sync fully succeeded - added README troubleshooting for token rotation on existing mirror repos For repos already affected right now, the immediate fix is still: - update token in Forgejo repo Settings -> Mirror Settings, or - delete and re-mirror from Gitea Mirror so it is recreated with current credentials.

kerem commented

2026-02-27 15:55:03 +03:00

Author

Owner

@arunavo4 commented on GitHub (Feb 24, 2026):

Resolved by #181: sync status wording is now accurate for async mirror pulls, and README now documents token-rotation behavior/workarounds for existing mirrors.

@arunavo4 commented on GitHub (Feb 24, 2026): Resolved by #181: sync status wording is now accurate for async mirror pulls, and README now documents token-rotation behavior/workarounds for existing mirrors.

Rows
Columns

[GH-ISSUE #171] Mirroring fails but reports success #86