forgejo session provider is memory, wipes on every pod rollout #127

New issue

Closed

opened 2026-05-26 04:24:33 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-26 04:24:33 +00:00

Owner

Symptom

Forgejo logs Kai out multiple times per day (4× on 2026-05-25). Sessions don't persist across pod recreations.

Root cause

[session] block in the live app.ini has no PROVIDER set, so Forgejo falls back to the memory provider. Sessions live only in the pod's RAM. With 7 ReplicaSets in 20 days (image bumps + config churn — current pod is 23h old, replaced by a fresh RS), every rollout wipes all active sessions. The PROVIDER_CONFIG = /var/lib/gitea/data/sessions path is a file-provider artifact doing nothing while the provider is memory.

Fix

Add to deploy/forgejo.yml container env:

- name: FORGEJO__session__PROVIDER
  value: db
- name: FORGEJO__session__PROVIDER_CONFIG
  value: ""
- name: FORGEJO__session__SESSION_LIFE_TIME
  value: "604800"

Postgres is already wired up via forgejo-db. The DB pod has restarted 8 times in 20 days, last 7d ago — much stabler than memory. SESSION_LIFE_TIME=604800 is 7 days.

Verification

After rollout, exec into the pod, confirm app.ini shows PROVIDER = db, and confirm the session table exists in postgres. Then leave a tab open across a manual kubectl rollout restart deploy/forgejo -n forgejo and confirm the session survives.

**Symptom** Forgejo logs Kai out multiple times per day (4× on 2026-05-25). Sessions don't persist across pod recreations. **Root cause** `[session]` block in the live `app.ini` has no `PROVIDER` set, so Forgejo falls back to the `memory` provider. Sessions live only in the pod's RAM. With 7 ReplicaSets in 20 days (image bumps + config churn — current pod is 23h old, replaced by a fresh RS), every rollout wipes all active sessions. The `PROVIDER_CONFIG = /var/lib/gitea/data/sessions` path is a file-provider artifact doing nothing while the provider is memory. **Fix** Add to `deploy/forgejo.yml` container env: ```yaml - name: FORGEJO__session__PROVIDER value: db - name: FORGEJO__session__PROVIDER_CONFIG value: "" - name: FORGEJO__session__SESSION_LIFE_TIME value: "604800" ``` Postgres is already wired up via `forgejo-db`. The DB pod has restarted 8 times in 20 days, last 7d ago — much stabler than memory. `SESSION_LIFE_TIME=604800` is 7 days. **Verification** After rollout, exec into the pod, confirm `app.ini` shows `PROVIDER = db`, and confirm the `session` table exists in postgres. Then leave a tab open across a manual `kubectl rollout restart deploy/forgejo -n forgejo` and confirm the session survives.

coilysiren referenced this issue from a commit

2026-05-26 04:25:03 +00:00

fix(forgejo): pin session provider to postgres with 7d TTL (closes https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/127)

coilysiren closed this issue

2026-05-26 04:25:03 +00:00

coilysiren referenced this issue

2026-06-17 06:11:16 +00:00

Forgejo daily logout: 7d session TTL not rolled out + kubectl kai-server.local Bad Gateway #350