Gitea: fatal: could not read Username for

[Jonas18175]

DockerImage: 25.4.1 (Helm Chart) on Linux
SelfHosted: Gitea

Describe the bug

I setup the Bot for Gitea with a Token - the Token works and it is able to receive the repos from that user, but when it try to run a ls-remote - than I get a "fatal: could not read Username for 'https://mygitea.company.io': No such device or address"
Why I get this? And why it can't use SSH for that?

Relevant debug logs

Click me to see logs

DEBUG: Using RE2 as regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /usr/src/app/config
DEBUG: File config
       "config": {
         "platform": "gitea",
         "endpoint": "https://mygitea.company.io/api/v1",
         "username": "serveruser",
         "gitAuthor": "serveruser <**retracted**>",
         "autodiscover": true
       }
DEBUG: CLI config
       "config": {}
DEBUG: Env config
       "config": {"hostRules": [], "token": "***********"}
DEBUG: Combined config
       "config": {
         "platform": "gitea",
         "endpoint": "https://mygitea.company.io/api/v1",
         "username": "serveruser",
         "gitAuthor": "serveruser <**retracted**>",
         "autodiscover": true,
         "hostRules": [],
         "token": "***********"
       }
DEBUG: Adding trailing slash to endpoint
DEBUG: Using configured gitAuthor (serveruser <**retracted**>)
DEBUG: Adding token authentication for mygitea.company.io to hostRules
DEBUG: Using baseDir: /tmp/renovate
DEBUG: Using cacheDir: /tmp/renovate/cache
DEBUG: Initializing Renovate internal cache into /tmp/renovate/cache/renovate/renovate-cache-v1
DEBUG: Commits limit = null
DEBUG: Auto-discovering Gitea repositories
 INFO: Autodiscovered repositories
       "length": 1,
       "repositories": [
         "Scripts/ExampleRepo",
       ]
DEBUG: Clearing hostRules
DEBUG: Adding token authentication for mygitea.company.io to hostRules
 INFO: Repository started (repository=Scripts/ExampleRepo)
       "renovateVersion": "25.4.1"
DEBUG: Using localDir: /tmp/renovate/repos/gitea/Scripts/ExampleRepo (repository=Scripts/ExampleRepo)
DEBUG: Scripts/ExampleRepo default branch = master (repository=Scripts/ExampleRepo)
DEBUG: git error (repository=Scripts/ExampleRepo)
       "err": {
         "task": {
           "commands": [
             "ls-remote",
             "--heads",
             "http://**redacted**@mygitea.company.io/Scripts/ExampleRepo.git"
           ],
           "format": "utf-8"
         },
         "message": "fatal: could not read Username for 'https://mygitea.company.io': No such device or address\n",
         "stack": "Error: fatal: could not read Username for 'https://mygitea.company.io': No such device or address\n\n    at Object.action (/usr/src/app/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:38:28)\n    at PluginStore.exec (/usr/src/app/node_modules/simple-git/src/lib/plugins/plugin-store.ts:24:29)\n    at /usr/src/app/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:109:40\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/usr/src/app/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:106:14)\n    at GitExecutorChain.<anonymous> (/usr/src/app/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:83:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/usr/src/app/node_modules/simple-git/src/lib/runners/git-executor-chain.js:5:58)\n    at processTicksAndRejections (internal/process/task_queues.js:93:5)"
       }

Additional context

[viceice]

Renovate normally doesn't support git over ssh.

[viceice]

Is the auth token from the same user?

I have renovate working very well with gitea.

[viceice]

Ok. I see in logs you normally access gitea via https, but renovate tries http access. Did you manually change this for sanitizing?

[Jonas18175]

No - I doesn't change that behavior. Can I force it to https? The site is served by a NGINX reverseproxy - it forces also https.

config.json: >-
    {"platform":"gitea", "endpoint":"https://mygitea.company.io/api/v1",
    "username":"serveruser", "gitAuthor":"serveruser
    <**retracted**>", "autodiscover":true}

That is my config - the token is set inside secret manifest.

[viceice]

Yes, you need to pass the right http headers from nginx to gitea or update the gitea config, so gitea knows it should always send https urls.

For options check the gitea cheat cheet.

[Jonas18175]

Yes - Now it worked. Thanks.
The problem was the gitea helm chart had the server.PROTOCOL = http - but I can't change that directly to https, because it use the protocol to build the internal url wrongly for the (health-check, listener etc [Listener tries to connect to https://]) - but changing the ROOT_URL to https://%(DOMAIN)s/ help as workaround.

[viceice]

yes, i use ROOT_URL to in my gitea helm values ;)

[viceice]

Solution: configure gitea ROOT_URL to the full url, so gitea knows how to create public urls.