railiance-cluster/workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md

id	type	title	domain	repo	topic_slug	status	flavor	owner	created	updated	state_hub_workstream_id
RCLUSTER-WP-0016	workplan	Fix the ingress timeout interrupting Forgejo OCI uploads	financials	railiance-cluster	railiance	finished	implementation	codex	2026-10-13	2026-10-13	c8d8d021-c971-55c2-b386-577ad69416d4

Forgejo upload timeout

The founder requested fixing rapp-playwright image publication on 2026-10-13. Large authenticated blob PUTs fail after 59998-60001ms with unexpected EOF. Traefik 3.6.7 has the default 60s read timeout; Forgejo is healthy and has disk headroom. Source/configuration ownership is S2 railiance-cluster.

Apply the managed timeout and prove image publication

id: RCLUSTER-WP-0016-T01
status: done
priority: high
state_hub_task_id: "1db02233-5ca5-5bd5-a221-65843e09ec6e"

Change only the shared websecure request-read timeout to 600s through a retained HelmChartConfig. Record ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED under the founder's scoped publication-fix instruction and approval of this concrete shared-ingress change. Use the existing k3s Helm controller; no ArgoCD application exists for this packaged component. Before apply, retain the one-argument rendered diff, server dry-run and capacity check. After apply, verify the controller rollout, stable HTTPS/authentication, real large blob upload, remote manifest digest and image pull. Revert the source argument to 60s if rollout health fails. Record the longer request-body allowance on the estate close-down checklist. No endpoint, TLS or identity policy changes.

Acceptance is runtime evidence and successful immutable publication; do not finish merely because the manifest was accepted. Evidence lives with the rapp-playwright publication report and a cluster execution receipt.

Executed verification — 2026-10-13

Source commit bad08fd712 was pushed and verified before server-side application. Installed chart rendering changes exactly one argument. Server dry-run and diff passed. Node requests were 3460m/4000m CPU; Traefik's rolling update completed without increasing declared requests.

The k3s Helm job completed and Deployment generation 2 became Ready with the 600s argument, still using Traefik 3.6.7. Forgejo version and reuse health returned HTTP 200; anonymous registry /v2/ still returned HTTP 401. The original image then published successfully: five large layers returned HTTP 201 after 85.5, 106.9, 111.4, 172.7 and 182.6 seconds. All were previously interrupted near 60s. Registry digest and raw OCI index SHA-256 match the tested local release: sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441.

Evidence: docs/evidence/2026-10-13-publication-diagnosis.json, 2026-10-13-publication-timeout-rollout.json and 2026-10-13-publication-upload-timings.json; the provider retains the remote manifest and independent pull receipt under rapp-playwright/docs/evidence/.

Residual: review the shared 600s allowance at production close-down, retained as live checklist row 23 in the-custodian/docs/security-close-down-checklist.md. The timeout remains bounded. Browser workload admission/deployment stays in rapp-playwright WP-0004; this workplan does not deploy it.

The newer rmgr sync was blocked by pre-existing archived unqualified T01-T06 IDs. The repository's documented statehub fix-consistency workflow pushed the source and created this plan/task. Its legacy warnings are not represented as newly fixed by this upload change.