From 67ee2fc28b8e5174de074d4eab4ed097b2f17839 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 17 Aug 2026 17:41:02 +0000 Subject: [PATCH] gitea: don't leave the admin account locked behind a password-change wall MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause of the "Failed to reach Gitea API" / 403 errors on every retry: `gitea admin user change-password` (used in the already-exists branch to sync the account's password to what the user just entered) defaults to setting must_change_password=true, unlike `user create` which was already pinned to --must-change-password=false. Once set, Gitea rejects every API call — including the sync script's own token-authenticated calls — with 403 "You must change your password", even though the token itself and GITEA_URL were both completely correct. Confirmed live via a direct curl against /api/v1/user. Pin the same flag on change-password that create already used. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01YEQNc4NfBST1m9NtCZVYa8 --- services/gitea.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/services/gitea.sh b/services/gitea.sh index 49e7c9e..ff62939 100644 --- a/services/gitea.sh +++ b/services/gitea.sh @@ -386,8 +386,16 @@ EOF # what was just entered rather than failing the whole install. if docker exec -u git gitea gitea admin user list 2>/dev/null | awk '{print $2}' | grep -qx "$GITEA_ADMIN_USER"; then _exists=true + # --must-change-password=false matters here: change-password + # defaults to setting that flag TRUE, which then makes Gitea + # reject every API call (including this script's own token-based + # calls) with 403 "You must change your password" until someone + # logs into the web UI and clears it by hand. Confirmed live — + # this silently broke the sync script on every retry against an + # already-existing account. docker exec -u git gitea gitea admin user change-password \ - --username "$GITEA_ADMIN_USER" --password "$GITEA_ADMIN_PASS" &>/dev/null + --username "$GITEA_ADMIN_USER" --password "$GITEA_ADMIN_PASS" \ + --must-change-password=false &>/dev/null _created=true break fi