claude-memory/graph/solutions/gitea-actions-runner-offline-must-use-internal-url-not-publi-f46835.md
Cal Corum b140d4d82a migrate: 313 memories from MemoryGraph
- 313 new markdown files created
- 30 relationships embedded
- 313 entries indexed
- State initialized with usage data
2026-02-13 11:11:48 -06:00

1.9 KiB

id type title tags importance confidence created updated
f4683542-eb76-4397-9e84-673c86a05904 solution Gitea Actions runner offline - must use internal URL not public domain
gitea
ci-cd
actions
runner
troubleshooting
docker
reverse-proxy
403-error
homelab
lxc-225
0.9 0.8 2026-02-05T19:24:11.871715+00:00 2026-02-05T19:24:11.871715+00:00

Problem: Gitea Actions runner showing as 'Offline' in admin UI, jobs stuck in 'Waiting' status with no steps executing. Runner container shows '403 Forbidden' errors when trying to fetch tasks.

Root Cause: Runner was configured with GITEA_INSTANCE_URL=https://git.manticorum.com (public domain), which routes through Nginx Proxy Manager reverse proxy. The reverse proxy blocks API access with 403 Forbidden, preventing runner registration and task fetching.

Solution: Configure runner to connect directly to Gitea on internal network using GITEA_INSTANCE_URL=http://10.10.0.225:3000 (local IP and port). This bypasses the reverse proxy and allows direct API communication.

Working Configuration: docker run -d --name gitea-runner --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -v gitea-runner-data:/data -e GITEA_INSTANCE_URL=http://10.10.0.225:3000 -e GITEA_RUNNER_REGISTRATION_TOKEN= gitea/act_runner:latest

Diagnostic Steps:

  1. Check runner status in Gitea admin UI (/admin/actions/runners)
  2. SSH to Gitea LXC: ssh root@10.10.0.225
  3. Check runner logs: docker logs gitea-runner
  4. Look for '403 Forbidden' or 'permission_denied' errors
  5. Test API access: curl -s https://git.manticorum.com/api/v1/version
  6. If getting 403 from reverse proxy, switch to internal URL

Environment:

  • Gitea on LXC 225 (10.10.0.225:3000)
  • Runner runs in Docker container on same LXC
  • Public access via https://git.manticorum.com (NPM reverse proxy)
  • Runner needs internal/direct access, not proxied access