From 523b950759b85dbe31438d1feb8c28a33a1ce3cb Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:25:51 -0700
Subject: [PATCH] fix: set proxy-body-size 0 on the Forgejo chart Ingress

Two Ingresses claim forgejo.riotpiao.com and nginx honours the older chart one,
so the annotation on the other never applied and OCI pushes over 1m got 413.
---
 k8s/bootstrap/phase3-forgejo/forgejo-values.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
index 99ef5eb..90ac4b7 100644
--- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
@@ -78,6 +78,18 @@ ingress:
   className: nginx
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # This chart Ingress and the hand-written one in
+    # k8s/bootstrap/ingress/ingress.yaml both claim forgejo.riotpiao.com.
+    # ingress-nginx breaks the tie by oldest creationTimestamp, and the chart's
+    # is older, so it is the one actually serving — the annotations on the other
+    # have never applied. Duplicate should be removed; until then these must
+    # live here or they do nothing.
+    #
+    # proxy-body-size 0 is required for the OCI registry: nginx defaults to 1m,
+    # so any image layer above that fails the push with 413.
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
   hosts:
     - host: forgejo.riotpiao.com
       paths: