`gitlab:`-formatted flake inputs now blocked by Cloudflare

Uncategorized
1

Since today I’m getting 403 errors when running nix flake update on my flake input url = "gitlab:gaj-nixos/shared"; , which is a public repo.

 nix flake update sharedConfig
warning: Git tree '/home/gaj/gaj-nixos-config' is dirty
warning: unable to download 'https://gitlab.com/api/v4/projects/gaj-nixos%2Fshared/repository/commits?ref_name=HEAD': HTTP error 403; using cached version

curl -sS "https://gitlab.com/api/v4/projects/gaj-nixos%2Fshared" shows that it’s now being blocked by Cloudflare.
EDIT:

`curl --show-headers “https://gitlab.com/api/v4/projects/gaj-nixos%2Fshared/repository/commits?ref_name=HEAD”` shows that it’s now being blocked by Cloudflare.

I was able to work around the problem by replacing gitlab: with git+https://gitlab.com/ in the flake input URL.

4 Likes
2

I can not reproduce. I get a proper 200 from the API with sensible payload.

It might be that CF sees you as a malicious user of the internet because you are in the wrong IP-block, you tried to many requests, or whatever else.

It might work again later, it might be permanent (for the IP).

3

Ah, thanks for the feedback. Now I realize I pasted the wrong curl command from my history, sorry :sweat_smile:

This is the one that fails for me:

 curl --show-headers "https://gitlab.com/api/v4/projects/gaj-nixos%2Fshared/repository/commits?ref_name=HEAD"
HTTP/2 403 
date: Sat, 10 Oct 2026 08:26:01 GMT
content-type: text/html; charset=UTF-8
content-length: 5638
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
content-security-policy: default-src 'none'; script-src 'nonce-tTjwZaMsiZw1fpgtLsWegM' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
server: cloudflare

Would you be so kind as to confirm if this one is working on your side @NobbZ please ?

4 
curl --show-headers "https://gitlab.com/api/v4/projects/gaj-nixos%2Fshared/repository/commits?ref_name=HEAD"
HTTP/2 403
date: Sat, 10 Oct 2026 08:45:49 GMT
content-type: text/html; charset=UTF-8
content-length: 5638
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
content-security-policy: default-src 'none'; script-src 'nonce-n7youGv6NYgdNoV3RjYFFI' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
server: cloudflare
5

Do you have an API key configured for GitLab in nix.conf?

If you do maybe it’s expired and nix is attempting to use it for gitlab: but not the https url.

6

hopefully this would fix it:

6 Likes
7

Can also repro this.

https://gitlab.com/api/v4/projects/rycee%2Fnur-expressions/repository/commits?ref_name=HEAD opens normally.

curl --show-headers https://gitlab.com/api/v4/projects/rycee%2Fnur-expressions/repository/commits?ref_name=HEAD
returns HTTP/2 403.

Switched from `gitlab:` to the genetic format for now

8

you can post this on twitter and tag Cloudflare Help (@CloudflareHelp) / X

9

Thanks to all for the replies so far. To answer @Lyndeno, no I don’t have any expired Gitlab API key.

So it seems like it’s a real problem, which could be fixed by @kiara’s proposed change in nix.

I don’t use Twitter / X, but I don’t mind if anyone else cross-posts this thread on it.

10

I also reproduce this, so I switched to the workaround. No gitlab API key on my end. Definitely not too many requests. I’m not sure it’s the IP range either - I’m using a supposedly reputable ISP and the requests were not behind VPN.

11

i use a burner account on x