Gitea + LFS + Ngnix Basic Auth help

[alatnet]

I have gitea installed as a separate docker container instance and have my nginx docker container proxying gitea through it fine with SSL and http redirect to https.
Also was able to get SSH auth working fine and was able to upload a non lfs project fine.

I've tried various things but nothing is prompting me to enter in a username and password for basic auth.
I have GCM installed with Git for Windows and have it working with my WSL installation and
when I did "echo 'url=https://[SERVER URL]/gitea/[USER]/[REPO].git' | git credential fill", it would prompt me for a username and password. But when trying to push a brand new repo to my gitea server, it doesnt prompt at all.

The problem that im encountering is this:

warning: Authentication error: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/locks/verify
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
batch response: Authentication required: Authorization error: https://[SERVER URL]/gitea/[USER]/[REPO].git/info/lfs/objects/batch
Check that you have proper access to the repository
Uploading LFS objects: 0% (0/101), 0 B | 0 B/s, done.
error: failed to push some refs to ‘192.168.1.2:[USER]/[REPO].git’

Im thinking it has to do with basic auth via nginx as this is what i have in my nginx config:

location ^~ /gitea/ {
    auth_basic "Administrator’s Area";
    auth_basic_user_file /etc/nginx/.htpasswd;

    allow all;

    client_max_body_size 512M;

    # make nginx use unescaped URI, keep "%2F" as is
    rewrite ^ $request_uri;
    rewrite ^/gitea(/.*) $1 break;

    proxy_pass http://gitea$uri;

    proxy_set_header Connection $http_connection;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Any help would be appreciated.

[bk2204]

Hey,

If the problem is indeed authentication, you should be able to reset the authentication credentials you use with the approach outlined in the Git FAQ. That should result in you being prompted again, at least.

I can't really say much more than that, because I don't use Gitea and am not familiar with it. The Gitea maintainers may be able to help you more than we can.

[alatnet]

what if im using the ssh config file to define the credentials to log in via ssh using an identity file?

[bk2204]

If you're authenticating over SSH, then you'll need to use the authentication token that Gitea gives you and disable the basic authentication in nginx for that URL path. That's because the token that Gitea issues over SSH won't be valid for the basic authentication.

[alatnet]

figured that would be it... i can probably keep the basic auth on the main gitea part and just carve out the lfs section to not use nginx basic auth.

[alatnet]

ok, i think i got it working!

    location ^~ /gitea/ {
        auth_basic "Administrator’s Area";
        auth_basic_user_file /etc/nginx/.htpasswd;

        allow all;

        location ~ /gitea/[\w\.]+/[\w\.]+/info/lfs {
                auth_basic off;
                client_max_body_size 512M;

                # make nginx use unescaped URI, keep "%2F" as is
                rewrite ^ $request_uri;
                rewrite ^/gitea(/.*) $1 break;

                proxy_pass http://gitea$uri;

                proxy_set_header Connection $http_connection;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }

        client_max_body_size 512M;

        # make nginx use unescaped URI, keep "%2F" as is
        rewrite ^ $request_uri;
        rewrite ^/gitea(/.*) $1 break;

        proxy_pass http://gitea$uri;

        proxy_set_header Connection $http_connection;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

by having a sub location that matches the lfs section of the url and disabling the basic auth for only that matched location, i was able to get it to upload.

[alatnet]

Ok, so, a bit of modification to the regex, instead of using [\w.]+ for the username and repo, it is a better idea to just use [\S]+.