mrf(media_proxy_warming): avoid adapter-level redirects

Drop follow_redirect/force_redirect from the HTTP options used when warming MediaProxy, relying on Tesla middleware instead (Hackney redirect handling can crash behind CONNECT proxies).

Also add a regression assertion in the policy test and document the upstream Hackney issues in ReverseProxy redirect handling.

lib/pleroma/reverse_proxy/client/hackney.ex

@@ -5,9 +5,12 @@
 defmodule Pleroma.ReverseProxy.Client.Hackney do
   @behaviour Pleroma.ReverseProxy.Client
 
-  # redirect handler from Pleb, slightly modified to work with Hackney
+  # In-app redirect handler to avoid Hackney redirect bugs:
+  # - https://github.com/benoitc/hackney/issues/527 (relative/protocol-less redirects can crash Hackney)
+  # - https://github.com/benoitc/hackney/issues/273 (redirects not followed when using HTTP proxy)
+  #
+  # Based on a redirect handler from Pleb, slightly modified to work with Hackney:
   # https://declin.eu/objects/d4f38e62-5429-4614-86d1-e8fc16e6bf33
-  # https://github.com/benoitc/hackney/issues/273
   @redirect_statuses [301, 302, 303, 307, 308]
   defp absolute_redirect_url(original_url, resp_headers) do
     location =

lib/pleroma/web/activity_pub/mrf/media_proxy_warming_policy.ex

@@ -27,7 +27,14 @@ defmodule Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy do
   end
 
   defp fetch(url) do
-    http_client_opts = Pleroma.Config.get([:media_proxy, :proxy_opts, :http], pool: :media)
+    # This module uses Tesla (Pleroma.HTTP) to fetch the MediaProxy URL.
+    # Redirect following is handled by Tesla middleware, so we must not enable
+    # adapter-level redirect logic (Hackney can crash on relative redirects when proxied).
+    http_client_opts =
+      [:media_proxy, :proxy_opts, :http]
+      |> Pleroma.Config.get(pool: :media)
+      |> Keyword.drop([:follow_redirect, :force_redirect])
+
     HTTP.get(url, [], http_client_opts)
   end