tegwick
8831a05aeb
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13590-a16f-7f60-be60-fd71627bc99d
68 lines
3.7 KiB
Markdown
68 lines
3.7 KiB
Markdown
# Forgejo image publication fixed — 2026-10-13
|
|
|
|
Release **0.1.0** is published and pullable on railiance01. Its immutable reference:
|
|
|
|
```text
|
|
forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441
|
|
```
|
|
|
|
The fetched OCI index bytes hash to exactly that digest, matching the image
|
|
previously tested by the independent agent. The linux/amd64 manifest is
|
|
`sha256:20d8310d44cd807579aca06df01090a7bb27892ce387519f9957e4dd67f64cc7`;
|
|
cluster pull resolved the expected config
|
|
`sha256:5bda1139fda091648b1e984f6be8119291ad5616263b206d62ac7986ba2762b3`.
|
|
This publication did not rebuild or alter the browser image and did not deploy
|
|
the browser workload.
|
|
|
|
## Cause and fix
|
|
|
|
The previous HTTP 499/500 responses were caused by the shared Traefik ingress
|
|
cutting off large request bodies at its default 60-second read deadline. Forgejo
|
|
reported `unexpected EOF`; retries of those interrupted sessions could report
|
|
`offset mismatch between file and model`. Authentication and smaller blobs
|
|
succeeded. Forgejo had no restarts and approximately 130GiB disk available.
|
|
|
|
The approved fix declares a **bounded 600-second read timeout** on the shared
|
|
`websecure` entry point through a k3s `HelmChartConfig`. This setting covers HTTPS
|
|
request bodies for all services on that entry point. Other timeouts, TLS and
|
|
registry authentication remain unchanged. Source is owned by railiance-cluster:
|
|
`install/traefik/railiance01-helmchartconfig.yaml`, initial published commit
|
|
`bad08fd712bded4aefe011d2cdad1f50ade8c43e`, workplan RCLUSTER-WP-0016.
|
|
The estate close-down checklist row 23 tracks review of the longer shared budget.
|
|
|
|
Rendering the installed chart with its actual base values produced exactly one
|
|
additional argument. Server dry-run and diff passed, capacity was checked, and
|
|
the k3s Helm controller rolled Traefik to generation 2, Ready, on the same 3.6.7
|
|
image. Forgejo version and reuse health returned HTTP 200; registry `/v2/` still
|
|
returned HTTP 401 without authentication. Rollback is a reviewed source change
|
|
back to 60s and reapplication through the same controller.
|
|
|
|
References: [Traefik entry-point timeout](https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/)
|
|
and [k3s managed customization](https://docs.k3s.io/networking/networking-services).
|
|
|
|
## Executed verification
|
|
|
|
- `docker push forgejo.coulomb.social/coulomb/rapp-playwright:0.1.0` succeeded.
|
|
Five large layers completed with HTTP 201 in 85.5, 106.9, 111.4, 172.7 and
|
|
182.6 seconds. Manifests published at 2026-10-13T18:15:17Z.
|
|
- `docker buildx imagetools inspect ...:0.1.0` returned the exact expected index.
|
|
The raw fetched index's SHA-256 was independently computed and matched.
|
|
- `ssh railiance01 'sudo k3s crictl pull <immutable-reference>'` succeeded, and
|
|
`crictl inspecti` confirmed the expected image config identity.
|
|
|
|
Retained [diagnosis](2026-10-13-publication-diagnosis.json),
|
|
[rollout and HTTPS checks](2026-10-13-publication-timeout-rollout.json),
|
|
[successful upload timings](2026-10-13-publication-upload-timings.json),
|
|
[remote index](2026-10-13-published-image-index.json),
|
|
[cluster pull](2026-10-13-published-image-pull.json), and
|
|
[release record](../../releases/0.1.0.json).
|
|
|
|
WP-0003-T01 is now done and WP-0003 is finished. Managed workload admission,
|
|
consumer binding, deployment and live browser recovery/rollback remain in
|
|
WP-0004-T01. The publication fix does not claim those outcomes or close discovery
|
|
and consumer-acceptance work.
|
|
|
|
The State Hub audit reconciled WP-0003 and its publication task to finished/done
|
|
with zero failures. The ingress owner's RCLUSTER-WP-0016 was also reconciled to
|
|
finished/done. Its deep audit still reports pre-existing archived task identifier
|
|
warnings; those records are outside this publication fix.
|