TODO: Fix Woodpecker TLS clone failure (use internal Forgejo URL)

todo-woodpecker-tls-clone-fix Todo

todo done platform woodpecker

Project

Problem

Woodpecker CI pipelines fail when connecting to services behind Tailscale funnels from inside the cluster. Git's HTTP transport, Kaniko, and twine all hit TLS EOF errors.

Root Cause

HTTP/2 + TLS interaction between client libraries and Tailscale's funnel proxy causes unexpected EOF. Internal k8s service URLs (plain HTTP) bypass the funnel entirely.

Status: PARTIALLY FIXED

Fixed (PRs merged)

Repo	Step	PR	Fix
pal-e-docs	clone	#73	Override clone URL to <code>http://forgejo-http.forgejo.svc.cluster.local</code>
pal-e-docs	build-and-push	#75	Registry → <code>harbor.harbor.svc.cluster.local</code> + <code>insecure: true</code>
pal-e-docs-mcp	clone	#15	Override clone URL to internal Forgejo
pal-e-docs-mcp	publish (URL)	#17	PyPI URL → internal Forgejo

pal-e-docs pipeline: ALL GREEN (pipeline #104)

Clone, test, build-and-push all succeed. Docker image deployed to Harbor.

pal-e-docs-mcp pipeline: publish still failing

Clone and lint pass. Publish step fails with exit code 1. Cannot read actual error — Woodpecker log streaming is broken. See todo-fix-mcp-pypi-publish for investigation plan.

Temporary kubectl fix still active

WOODPECKER_FORGEJO_URL set to internal URL via kubectl. NOT in Terraform — will be overwritten on next tofu apply. Permanent fix still needed in terraform/main.tf.

Other repos not yet fixed

Any other repo with a Woodpecker pipeline that talks to funnel-proxied services will hit the same TLS EOF. Each needs clone URL overrides in .woodpecker.yaml.

Files to Change (permanent fix)

terraform/main.tf — Woodpecker Helm values: WOODPECKER_FORGEJO_URL to internal
ArgoCD app specs — update repoURL for all apps to use internal Forgejo service

todo-fix-mcp-pypi-publish — the remaining publish failure
deployment-lessons — platform stability patterns