Login to weblate with self-hosted Gitlab instance not possible

[dleidert]

I run both, a Weblate (5.3.1) and a Gitlab (16.7.2-ee) instance. Both are on the same system, both are run via Docker, and for both Apache2 is acting as a reverse proxy making them available via HTTPS. I've created an application, gave it the read_user scope (but I also tested with all scopes enabled) and added the application ID, the secret, and the URL to weblate's docker-compose file (WEBLATE_SOCIAL_AUTH_GITLAB_API_URL, WEBLATE_SOCIAL_AUTH_GITLAB_KEY, WEBLATE_SOCIAL_AUTH_GITLAB_SECRET).

When I'm logged in to my Gitlab instance and try to login in weblate with the Gitlab provider, I see a small windows asking if I want to authorize the application. I then click on Authorize and receive on the weblate side an error that translates to Authentication could not be performed, probably due to an expired token or a connection error.. The log contains:

weblate_1   | gunicorn stderr | [2024-01-12 20:45:55,472: WARNING/369] Handled exception: AuthFailed: Authentication failed: HTTPSConnectionPool(host='...', port=443): Max retries exceeded with url: /oauth/token (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7fda24029c10>: Failed to establish a new connection: [Errno 111] Connection refused'))

Edit: Here the relevant Apache log entries (no indication of an error):

[12/Jan/2024:21:05:58 +0100] "GET /oauth/authorize?client_id=<..>&redirect_uri=https://<weblate-domain>/accounts/complete/gitlab/&state=<..>&response_type=code&scope=read_user+read_user HTTP/1.1" 200 9199 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
[12/Jan/2024:21:05:58 +0100] "GET /-/manifest.json HTTP/1.1" 304 1064 "https://<gitlab-domain>/oauth/authorize?client_id=<..>&redirect_uri=https://<weblate-domain>/accounts/complete/gitlab/&state=<..>&response_type=code&scope=read_user+read_user" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
[12/Jan/2024:21:05:59 +0100] "POST /oauth/authorize HTTP/1.1" 302 1098 "https://<gitlab-domain>/oauth/authorize?client_id=<..>&redirect_uri=https://<weblate-domain>/accounts/complete/gitlab/&state=<..>&response_type=code&scope=read_user+read_user" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"

Any idea, what is wrong here? Is this a bug?

[nijel]

Most likely a network issue. Weblate can not reach Gitlab.

[dleidert]

I don't think that's the reason. As I said: I am seeing the "Authorize" dialog in gitlab after clicking the gitlab-Button in weblate. Also the logs indicate that the POST action to the gitlab URL is successful.

[nijel]

Yes, your browser can access both, but the servers can not reach each other. That's what the Weblate log says.

[dleidert]

Thanks for the pointer. I got a shell in the weblate container and ran curl against the gitlab URL, and that indeed failed. The reason was an entry in the host's /etc/hosts file, where the gitlab URL was pointing to the localhost address. After removing that entry, everything works like a charm. Thanks for your help.