Error authenticating, but Token works

[Psychi1]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

gitea_v1.22.1 and renovate_v39.40.1

Please tell us more about your question or problem

Hi there,

I'm trying to use renovate on a self-hosted gitea (via docker), using nginx as a reverse proxy. I have followed a lot of tutorials, but every time I get the same error.

 Error authenticating with Gitea. Check your token

I have tried using Firefox to access the site with the token and it works:

Any idea where the problem is?

Logs (if relevant)

Logs

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /workspace/renovate-bot/renovate-config/config.js
DEBUG: File config
       "config": {
         "endpoint": "https://<FQDN>/api/v1",
         "gitAuthor": "Renovate Bot <renovate@<FQDN>>",
         "platform": "gitea",
         "onboardingConfigFileName": "renovate.json",
         "autodiscover": true,
         "optimizeForDisabled": true
       }
DEBUG: CLI config
       "config": {}
DEBUG: Env config
       "config": {"hostRules": [], "configMigration": true, "token": "***********"}
DEBUG: Combined config
       "config": {
         "endpoint": "https:/<FQDN>/api/v1",
         "gitAuthor": "Renovate Bot <renovate@<FQDN>>",
         "platform": "gitea",
         "onboardingConfigFileName": "renovate.json",
         "autodiscover": true,
         "optimizeForDisabled": true,
         "hostRules": [],
         "configMigration": true,
         "token": "***********"
       }
DEBUG: Adding trailing slash to endpoint
DEBUG: Found valid git version: 2.47.1
DEBUG: Setting global hostRules
DEBUG: hostRules: authentication already set for <FQDN>
DEBUG: Using queue: host=<FQDN>, concurrency=16
DEBUG: GET https://<FQDN>/api/v1/user = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=401 retryCount=0, duration=37)
DEBUG: Error authenticating with Gitea. Check your token
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1732965668188,
           "socket": 1732965668190,
           "lookup": 1732965668191,
           "connect": 1732965668192,
           "secureConnect": 1732965668197,
           "upload": 1732965668197,
           "response": 1732965668222,
           "end": 1732965668225,
           "phases": {
             "wait": 2,
             "dns": 1,
             "tcp": 1,
             "tls": 5,
             "request": 0,
             "firstByte": 25,
             "download": 3,
             "total": 37
           }
         },
         "message": "Response code 401 (Unauthorized)",
         "stack": "HTTPError: Response code 401 (Unauthorized)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/39.40.1 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://<FQDN>/api/v1/user",
           "hostType": "gitea",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         },
         "response": {
           "statusCode": 401,
           "statusMessage": "Unauthorized",
           "body": {
             "message": "user does not exist [uid: 0, name: ]",
             "url": "https://<FQDN>/api/swagger"
           },
           "headers": {
             "server": "nginx/1.26.1",
             "date": "Sat, 30 Nov 2024 11:21:08 GMT",
             "content-type": "application/json;charset=utf-8",
             "content-length": "97",
             "connection": "keep-alive",
             "cache-control": "max-age=0, private, must-revalidate, no-transform",
             "x-content-type-options": "nosniff, nosniff",
             "x-frame-options": "SAMEORIGIN",
             "x-xss-protection": "1; mode=block",
             "referrer-policy": "no-referrer-when-downgrade",
             "permissions-policy": "interest-cohort=()",
             "strict-transport-security": "max-age=15770000; includeSubDomains"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }
FATAL: Authentication failure
 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 60,
           "logContext": "i3ewVyffD9i9BrobMkOcE",
           "msg": "Authentication failure"
         }
       ]

[javiertury]

I was having the same issue with my gitea instance. I could successfully run curl against the api endpoint that was returning 404 The target couldn't be found to renovatebot with the same token.

After some debugging I found the culprit. I run renovatebot using a workflow like this

jobs:
  renovate:
    runs-on: ubuntu-latest

    steps:
      - name: Self-hosted Renovate
        uses: https://github.com/renovatebot/github-action@v41.0.5
        with:
          token: ${{ secrets.TOKEN }}
        env:
          RENOVATE_PLATFORM: gitea
          RENOVATE_ONBOARDING: false
          RENOVATE_ENDPOINT: '${{ gitea.server_url }}/api/v1/'

The variable gitea.server_url resolves to http://gitea-http.gitea:3000, which is an internal domain for the internal kubernetes network and it is the url that gitea-act-runner uses to connect to gitea. Even though the gitea server answers correctly to requests for gitea-http.gitea:3000, it is configured with a different public url, e.g. ROOT_URL=https://gitea.mydomain.com.

The problem arises when the endpoint at gitea-http.gitea:3000 somehow redirects renovatebot to use the public domain gitea.mydomain.com instead. Renovatebot then starts to use the public endpoint for the requests, but it forgets to attach the Authorization header when redirected to the public endpoint. This is why gitea returns 404 The target couldn't be found.

To work around this issue, just configure renovate with a gitea endpoint that doesn't do redirections. Try to use your final url in RENOVATE_ENDPOINT: https://gitea.mydomain.com/api/v1/.

[rarkins]

Gitea users are welcome to contribute a PR adding advice to https://github.com/renovatebot/renovate/blob/main/lib/modules/platform/gitea/readme.md to point Renovate to a non-redirecting endpoint.

You're also welcome to create a "Submit an Idea" discussion suggesting how support for redirecting endpoints could be supported. I don't see the point of this however, because:

• Supporting redirection implies that Renovate must be able to reach both the internal and external URLs
• If you can reach the external URL, you can simply point Renovate to that URL in the first place

It's a one-time setup, a change of maybe 20-30 characters.

[javiertury]

Sorry for the previous post.

Regarding the issue at hand, let me try to argue why it would be desirable to have it fixed in renovatebot. The problem comes from the following pagination code

renovate/lib/modules/platform/gitea/pr-cache.ts

Lines 123 to 141 in ca9e7f3

	let url: string | undefined =
	`${API_PATH}/repos/${this.repo}/pulls?${query}`;
	while (url) {
	const res: HttpResponse<PR[]> = await http.getJson<PR[]>(url, {
	memCache: false,
	paginate: false,
	});
	const needNextPage = this.reconcile(res.body);
	if (!needNextPage) {
	break;
	}
	url = parseLinkHeader(res.headers.link)?.next?.url;
	}
	return this;
	}

We can see that the first query in this loop correctly queries the configured endpoint. However subsequent iterations use the next link provided by gitea, which may use a different endpoint. This problem seems to be localized here, since other pagination fragments use a method that doesn't trigger this error lib/util/http/gitea.ts.

It's not uncommon for gitea setups to have 2 endpoints: one public and another private. Following recommended security practices aimed at reducing the attack surface, public endpoints expose only what is strictly needed (e.g. website and git ssh port), blocking features that are only used internally (e.g. metrics and api in the case of hobbyists). Making renovate connect through the public endpoint implies that the api must be exposed. It is desirable that renovate uses the endpoint that has been configured by the user. I am about to split hairs, but imagine that a user configures an https endpoint and then renovate switches to an insecure http endpoint because gitea is slightly misconfigured.

That said, I also understand how in the big scheme of things, a workaround for this issue may be enough. In such a case, I wouldn't mind to write it up on the docs.

EDIT: Digging in the code, similar problems seem to occur in gitlab (renovatebot/config-help#501) and github setups

renovate/lib/util/http/gitlab.ts

Lines 43 to 47 in ca9e7f3

	if (process.env.GITLAB_IGNORE_REPO_URL) {
	const defaultEndpoint = new URL(baseUrl);
	nextUrl.protocol = defaultEndpoint.protocol;
	nextUrl.host = defaultEndpoint.host;
	}

renovate/lib/util/http/github.ts

Lines 335 to 340 in ca9e7f3

	const parsedUrl = new URL(next.url, baseUrl);
	const rebasePagination =
	!!baseUrl &&
	!!process.env.RENOVATE_X_REBASE_PAGINATION_LINKS &&
	// Preserve github.com URLs for use cases like release notes
	parsedUrl.origin !== 'https://api.github.com';

[viceice]

feel free to implement the RENOVATE_X_REBASE_PAGINATION_LINKS workaround for gitea.

[Psychi1]

Hello,

I digged more and more and found another tutorial, which was more clear with the instructions.

So I will summerize my solutions in a short way:

User: renovate-bot

renovate-config/config.js

module.exports = {
    "endpoint": "https://<FQDN>/api/v1", // replace it with your actual endpoint
    "gitAuthor": "Renovate Bot <renovate@<FQDN>>",
    "platform": "gitea",
    "onboardingConfigFileName": "renovate.json",
    "autodiscover": true,
    "optimizeForDisabled": true
};

renovate-config/.gitea/workflows/renovate.yaml

name: renovate

on:
  schedule:
    - cron: "@daily"
  push:
    branches:
      - main

jobs:
  renovate:
    runs-on: ubuntu-latest
    container: ghcr.io/renovatebot/renovate:39.40.1
    steps:
      - uses: actions/checkout@v4
      - run: renovate
        env:
          RENOVATE_CONFIG_FILE: "/workspace/renovate-bot/renovate-config/config.js" # replace it with your config.js path
          LOG_LEVEL: "debug"
          RENOVATE_CONFIG_MIGRATION: "true" # ensure all repositories receive config migration PRs
          RENOVATE_ONBOARDING: false
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # your Revonate bot token
          RENOVATE_ENDPOINT: "https://<FQDN>/api/v1/"

User: gitea-user

renovate-config/config.js

module.exports = {
    "endpoint": "https://<FQDN>/api/v1", // replace it with your actual endpoint
    "gitAuthor": "Renovate Bot <renovate@<FQDN>>",
    "platform": "gitea",
    "onboardingConfigFileName": "renovate.json",
    "autodiscover": true,
    "optimizeForDisabled": true
};

renovate-config/.gitea/workflows/renovate.yaml

on:
  schedule:
    - cron: "@daily"
  push:
    branches:
      - main

jobs:
  renovate:
    runs-on: ubuntu-latest
    container: ghcr.io/renovatebot/renovate:39.40.1
    steps:
      - uses: actions/checkout@v4
      - run: renovate
        env:
          RENOVATE_CONFIG_FILE: "/workspace/gitea-user/renovate-config/config.js" # replace it with your config.js path
          LOG_LEVEL: "debug"
          RENOVATE_CONFIG_MIGRATION: "true" # ensure all repositories receive config migration PRs
          RENOVATE_ONBOARDING: false
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # your Revonate bot token
          GITHUB_COM_TOKEN: ${{ secrets.TOKEN_GITHUB }}

Renovate failed, after pushing to the bot repo, but not if pushing to the user repo.