[antoinetoussaint-byte]

Closes #967.

What we are trying to do

Let Argo CD sync a local promotion from the k3d fetch remote, so codefly run cluster delivers end to end.

What was wrong

The remote was nginx serving the mirror as static files (dumb HTTP). Argo CD v3.4 lists refs with go-git, which speaks only smart HTTP: its info/refs?service=git-upload-pack got text/plain, and every ApplicationSet failed with failed to list refs: unexpected EOF. The CLI probe read the dumb info/refs, so it reported the remote healthy.

Change

• The served image is built locally FROM the pinned nginx base with Alpine git, git-daemon (git-http-backend; same git build) and fcgiwrap, all pinned (owner-approved third party, local build only), pushed to the environment registry and run by digest.
• nginx serves info/refs and git-upload-pack through git http-backend as nginx's user over the read-only mount (safe.directory scoped to the mirror); git-receive-pack gets 403.
• The entrypoint fails the container when fcgiwrap cannot open its socket, rather than serving 502s.
• The probe asks for the smart advertisement and requires its content type.

Classification: a fix at the owner of the fetch remote.

Verified

• Live on k3d (Argo CD v3.4.1): the ApplicationSet reports All applications have been generated successfully and every saas Application synced. Standalone: the advertisement is application/x-git-upload-pack-advertisement listing the reviewed revision, git ls-remote succeeds, receive-pack is refused.
• Unit tests for the pinned Dockerfile, the read-only smart config and the pkt-line parser; golangci-lint clean.

Not verified: the k3d qualification test in CI, if it does not run there.

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Closing for a re-cut. The diagnosis here is good and the finding is untouched — pkg/gitops/remote.go:1014 on main still reads the dumb info/refs advertisement, so Argo CD's go-git still cannot list refs from the local fetch remote and the CLI probe still reports it healthy.

Two things the re-cut has to answer that this branch could not know:

1. The base image. It builds the served image FROM nginx:1.27.3-alpine@sha256:4152…, i.e. from Docker Hub. The owner ruled Docker Hub out outright on 2026-10-23, and obin-ai/infra-base#1438 carried that through by deleting every catalog mirror. (Main's remoteImage constant has the same Docker Hub pin, so this is inherited rather than introduced — but a PR that builds a new image from it is where the rule has to be met.) The re-cut names a base in the one registry.
2. Whether the path is still maintained. 7a33ba12 (feat(run)!: codefly run workspace, and a native run stands in as the composition's cluster (#958) #977, 2026-10-13) made a native run stand in as the composition's cluster, and pkg/gitops/remote.go has had no change since 98c561a3 on 2026-10-11. The smart-HTTP fix is only worth re-cutting if codefly run cluster is still a loop we keep.

Everything else about it stands and should be lifted into the re-cut as-is: git http-backend behind fcgiwrap as nginx's user, 403 on git-receive-pack, the container failing rather than serving 502s, and a probe that requires application/x-git-upload-pack-advertisement. Branch issue-967-smart-http-remote is kept; #967 stays the record.