From e17b0e0b413e27147a938d5008a24c69f7601380 Mon Sep 17 00:00:00 2001
From: Erki Aas <erki@veebkolm.ee>
Date: Tue, 15 Sep 2026 22:38:10 +0300
Subject: [PATCH] Make gitea OAuth2 JWT_SECRET a valid, stable 43-char key

GITEA__OAUTH2__JWT_SECRET must base64url-decode to 32 bytes. The size-32
claim decoded to 24 bytes, so 1.27 rejected it and generated its own key
on each boot; since app.ini lives on an emptyDir that regenerated every
restart and logged out all OAuth2 clients. size 43 decodes to 32 bytes,
so the rotated key is accepted and stays stable across restarts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 gitea/application.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/gitea/application.yaml b/gitea/application.yaml
index cbb47cb..8c73ee4 100644
--- a/gitea/application.yaml
+++ b/gitea/application.yaml
@@ -49,12 +49,17 @@ spec:
     - key: GITEA__SECURITY__INTERNAL_TOKEN
       value: "%(plaintext)s"
 ---
+# size 43: GITEA__OAUTH2__JWT_SECRET must base64url-decode to exactly 32 bytes.
+# A 43-char value decodes to 32 bytes; a 32-char one decodes to 24 and Gitea
+# rejects it and generates its own key each boot, which (app.ini is on an
+# emptyDir) changes on every restart and logs out all OAuth2 clients. 43 keeps
+# the rotated key valid and stable.
 apiVersion: codemowers.cloud/v1beta1
 kind: SecretClaim
 metadata:
   name: gitea-oauth2-jwt
 spec:
-  size: 32
+  size: 43
   mapping:
     - key: GITEA__OAUTH2__JWT_SECRET
       value: "%(plaintext)s"