Git LFS behind redirect signed proxy, arbitrary but consistent 403

Support
,
1

Netlify site name: https://kroltan.netlify.app

I have a redirect of a subdomain to some other server:

[[redirects]]
from = "https://git.kroltan.me/*"
to = "https://home.kroltan.me:3004/:splat"
force = true
signed = "MY_JWS_KEY_SECRET_VAR"
status = 200
headers = { X-Forwarded-Host = "git.kroltan.me" }

On that server lives a Forgejo instance, from which I’m trying to clone a repository over HTTPS that contains a bunch of LFS files. However, at some point during that process, one of the requests Git does fails.

This is the output of GIT_CURL_VERBOSE=1 git clone https://git.kroltan.me/Troposphir/atmosphir-voxelus-game-client.git:

17:42:55.477935 trace git-lfs: HTTP: POST https://git.kroltan.me/Troposphir/atmosphir-voxelus-game-client.git/info/lfs/objects/batch
> POST /Troposphir/atmosphir-voxelus-game-client.git/info/lfs/objects/batch HTTP/1.1
> Host: git.kroltan.me
> Accept: application/vnd.git-lfs+json
> Authorization: Basic * * * * *
> Content-Length: 227
> Content-Type: application/vnd.git-lfs+json; charset=utf-8
> User-Agent: git-lfs/3.7.1 (GitHub; linux amd64; go 1.25.3 X:nodwarf5)
>
{"operation":"download","objects":[{"oid":"e0f06fd5039c227ab65be7d69929f25b90b1676764d4372da0c67eb3cd42db26","size":5892}],"transfers":["lfs-standalone-file","basic","ssh"],"ref":{"name":"refs/heads/main"},"hash_algo":"sha256"}17:42:55.490734 trace git-lfs: HTTP: 403


< HTTP/2.0 403 Forbidden
< Connection: close
< Content-Type: text/html; charset=utf-8
< Date: Mon, 08 Jun 2026 20:42:55 GMT
< Server: Netlify
< X-Nf-Request-Id: 01KTMFJQKF8KCP3KB732HQSZAR

While I am using a signed proxy, the issue manifests even without signing.

I can consistently reproduce this issue every time I try to use LFS on this repository that contains a lot of files.

Initially I thought this was an application issue, since the exact same setup on the gitea subdomain, with that software instead, works. But I have monitored the server logs and this 403 is being delivered by Netlify specifically. While most requests do reach my server normally, the one that gets 403’d does not reach my server.

What is going on here? How can I fix this? I’d rather keep Netlify in front of my actual URL since I can’t host on a standard port.

2

If I attempt the same clone through a VPN with an exit node far away, then it succeeds.

Could it have something to do with the fact that the computer I’m testing on is on the same local network as the server, so it’s too fast and triggering some sort of anti-bot protection? I’d expect a 429 or something in that case, but who knows.