Completes the post-breach (CVE-2026-59774) secret split. SECRET_KEY moves
from the shared gitea-random claim to a dedicated gitea-secret-key claim
with a fresh value, and the now-unused gitea-random claim is removed
(ArgoCD prunes it).
The earlier concern that rotating SECRET_KEY breaks the 2 push mirrors was
wrong: their gitlab.com credentials live in each repo's on-disk git config,
not in SECRET_KEY-encrypted storage. Blast radius here is negligible: 0 TOTP
2FA, 0 Actions secrets, 0 runner tokens, pull mirrors are public. SECRET_KEY
has no length constraint (Gitea hashes it to derive the AES key), so unlike
JWT_SECRET size 32 is fine and is not regenerated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GITEA__OAUTH2__JWT_SECRET must base64url-decode to 32 bytes. The size-32
claim decoded to 24 bytes, so 1.27 rejected it and generated its own key
on each boot; since app.ini lives on an emptyDir that regenerated every
restart and logged out all OAuth2 clients. size 43 decodes to 32 bytes,
so the rotated key is accepted and stays stable across restarts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Post-breach (CVE-2026-59774) rotation. All three security secrets shared
one generated value via the gitea-random SecretClaim, and the file-read
exploit leaked it. Split INTERNAL_TOKEN and JWT_SECRET into their own
claims (gitea-internal-token, gitea-oauth2-jwt) with fresh distinct
values and repoint the StatefulSet at them.
INTERNAL_TOKEN is the secret the attacker actually used against the
still-internet-reachable /api/internal, so this closes reuse of any saved
copy. Rotating JWT_SECRET invalidates gitea-issued OAuth2 and LFS tokens,
so the OAuth2 integrations (Woodpecker, tea, credential helpers) need one
re-login.
SECRET_KEY is deliberately left on gitea-random: rotating it would break
the 2 push mirrors (encrypted creds) and must be done in a window that
re-enters those credentials.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The rootless image defaulted SSH_LISTEN_PORT to SSH_PORT until 1.26; in
1.27 docker-setup.sh leaves it empty, so Gitea fell back to SSH_PORT=22
and crash-looped with "listen tcp :22: bind: permission denied" as uid
1000. The Service already maps 22 -> 2222, so pin the listen port
explicitly rather than depending on an image default.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the
Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive)
affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10
to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack
packObjectsHook that ran a Monero miner on every clone. The 1.25 branch
never received the fix, so this skips 1.26.
Env-var config still works: the rootless image's environment-to-ini is
now a shim for `gitea config edit-ini --in-place --apply-env`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Erki AasandClaude Opus 4.8
rasmus
eaas
lauri