[Bug] Gitea fails to start due to invalid ACME_DIRECTORY configuration causing certificate issuance failure

[KaidRommel]

Description

Gitea fails to start when attempting to automatically obtain HTTPS certificates via ACME (Let's Encrypt). The error logs indicate an invalid ACME_DIRECTORY configuration, leading to incorrect file paths and HTTP request failures.

version: "3"

networks:
  gitea:
    external: false

services:
  server:
    image: docker.gitea.com/gitea:1.23.5
    container_name: gitea
    environment:
      - USER_UID=1003
      - USER_GID=1003
    restart: always
    networks:
      - gitea
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /home/git/.ssh/:/data/git/.ssh
    ports:
      - "443:3000"
      - "80:3080"
      - "222:22"
      - "127.0.0.1:2222:22"

[server]
APP_DATA_PATH = /data/gitea
DOMAIN = git.myhostname.com
SSH_DOMAIN = git.myhostname.com
ENABLE_ACME = true
ACME_ACCEPTTOS = true
ACME_DIRECTORY = https
ACME_EMAIL = mymail@mail.com
PROTOCOL  = https
HTTP_PORT = 3000
ROOT_URL = https://git.myhostname.com/
REDIRECT_OTHER_PORT = true
PORT_TO_REDIRECT = 3080
DISABLE_SSH = false
SSH_PORT = 22
SSH_LISTEN_PORT = 22
LFS_START_SERVER = true
LFS_JWT_SECRET = ********
OFFLINE_MODE = true

Gitea Version

1.23.5

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

https://gist.github.com/KaidRommel/2ac31fd904b05879a8d116240f9efebf

Screenshots

No response

Git Version

No response

Operating System

docker.gitea.com/gitea:1.23.5

How are you running Gitea?

docker

Database

SQLite

[wxiaoguang]

It should have been fixed in 1.23-nightly (will be 1.23.6)

• https://dl.gitea.com/gitea/1.23-nightly/
• https://hub.docker.com/r/gitea/gitea/tags?name=1.23-nightly

[KaidRommel]

It should have been fixed in 1.23-nightly (will be 1.23.6)

• https://dl.gitea.com/gitea/1.23-nightly/
• https://hub.docker.com/r/gitea/gitea/tags?name=1.23-nightly

@wxiaoguang Thank you for your timely help! After switching to the 1.23-nightly version, the ACME certificate acquisition process can correctly recognize the ACME_CA_URL, but there is still an issue with ACME directory. Below is the key portion of the current error log:

1.7427377084394832e+09  info    creating new account because no account for configured email is known to us     {"email": "mymail@mail.com", "ca": "https://acme-v02.api.letsencrypt.org/directory", "error": "open https/acme/acme-v02.api.letsencrypt.org-directory/users/mymail@mail.com/mymail.json: no such file or directory"}
1.742737708439539e+09   info    ACME account has empty status; registering account with ACME server     {"contact": ["mailto:mymail@mail.com"], "location": ""}

[wxiaoguang]

Could you remove your "https" directory and retry?

[KaidRommel]

Could you remove your "https" directory and retry?

The HTTPS directory has not been created yet.

e890821f6d1c:/data# ls
cert.pem  git       gitea     key.pem   ssh

e890821f6d1c:/data/gitea# ls
actions_artifacts  avatars            home               log                repo-archive       tmp
actions_log        conf               indexers           packages           repo-avatars
attachments        gitea.db           jwt                queues             sessions

[wxiaoguang]

IIRC it is in the /app/gitea directory (well, another legacy problem which hasn't been fixed yet)

-> ACME default storage not using work-path setting #26590