I'm trying to clone meta-raspberrypi and I'm getting this:

$ GIT_CURL_VERBOSE=1 git clone https://git.yoctoproject.org/git/meta-raspberrypi/
Cloning into 'meta-raspberrypi'...
21:38:40.094986 http.c:725              == Info: Couldn't find host git.yoctoproject.org in the (nil) file; using defaults
21:38:40.241124 http.c:725              == Info:   Trying 104.18.1.115:443...
21:38:40.261628 http.c:725              == Info: Connected to git.yoctoproject.org (104.18.1.115) port 443 (#0)
21:38:40.292612 http.c:725              == Info: found 428 certificates in /etc/ssl/certs
21:38:40.292649 http.c:725              == Info: GnuTLS ciphers: NORMAL:-ARCFOUR-128:-CTYPE-ALL:+CTYPE-X509:-VERS-SSL3.0
21:38:40.292676 http.c:725              == Info: ALPN: offers h2,http/1.1
21:38:40.315756 http.c:725              == Info: SSL connection using TLS1.3 / ECDHE_RSA_AES_256_GCM_SHA384
21:38:40.317595 http.c:725              == Info:   server certificate verification OK
21:38:40.317602 http.c:725              == Info:   server certificate status verification SKIPPED
21:38:40.317667 http.c:725              == Info:   common name: git.yoctoproject.org (matched)
21:38:40.317672 http.c:725              == Info:   server certificate expiration date OK
21:38:40.317675 http.c:725              == Info:   server certificate activation date OK
21:38:40.317681 http.c:725              == Info:   certificate public key: EC/ECDSA
21:38:40.317683 http.c:725              == Info:   certificate version: #3
21:38:40.317693 http.c:725              == Info:   subject: CN=git.yoctoproject.org
21:38:40.317698 http.c:725              == Info:   start date: Tue, 07 Apr 2026 20:09:32 GMT
21:38:40.317702 http.c:725              == Info:   expire date: Mon, 06 Jul 2026 21:09:28 GMT
21:38:40.317714 http.c:725              == Info:   issuer: C=US,O=Google Trust Services,CN=WE1
21:38:40.317722 http.c:725              == Info: ALPN: server accepted h2
21:38:40.317770 http.c:725              == Info: using HTTP/2
21:38:40.317794 http.c:725              == Info: h2h3 [:method: GET]
21:38:40.317798 http.c:725              == Info: h2h3 [:path: /git/meta-raspberrypi/info/refs?service=git-upload-pack]
21:38:40.317801 http.c:725              == Info: h2h3 [:scheme: https]
21:38:40.317803 http.c:725              == Info: h2h3 [:authority: git.yoctoproject.org]
21:38:40.317806 http.c:725              == Info: h2h3 [user-agent: git/2.39.5]
21:38:40.317810 http.c:725              == Info: h2h3 [accept: */*]
21:38:40.317813 http.c:725              == Info: h2h3 [accept-encoding: deflate, gzip, br, zstd]
21:38:40.317816 http.c:725              == Info: h2h3 [accept-language: en-US, *;q=0.9]
21:38:40.317819 http.c:725              == Info: h2h3 [pragma: no-cache]
21:38:40.317822 http.c:725              == Info: h2h3 [git-protocol: version=2]
21:38:40.317828 http.c:725              == Info: Using Stream ID: 1 (easy handle 0x558ebbedf1f0)
21:38:40.317852 http.c:672              => Send header, 0000000253 bytes (0x000000fd)
21:38:40.317858 http.c:684              => Send header: GET /git/meta-raspberrypi/info/refs?service=git-upload-pack HTTP/2
21:38:40.317860 http.c:684              => Send header: Host: git.yoctoproject.org
21:38:40.317862 http.c:684              => Send header: user-agent: git/2.39.5
21:38:40.317865 http.c:684              => Send header: accept: */*
21:38:40.317866 http.c:684              => Send header: accept-encoding: deflate, gzip, br, zstd
21:38:40.317869 http.c:684              => Send header: accept-language: en-US, *;q=0.9
21:38:40.317871 http.c:684              => Send header: pragma: no-cache
21:38:40.317873 http.c:684              => Send header: git-protocol: version=2
21:38:40.317875 http.c:684              => Send header:
21:38:40.341603 http.c:672              <= Recv header, 0000000013 bytes (0x0000000d)
21:38:40.341609 http.c:684              <= Recv header: HTTP/2 403
21:38:40.341612 http.c:672              <= Recv header, 0000000037 bytes (0x00000025)
21:38:40.341614 http.c:684              <= Recv header: date: Tue, 07 Apr 2026 21:38:40 GMT
21:38:40.341616 http.c:672              <= Recv header, 0000000040 bytes (0x00000028)
21:38:40.341618 http.c:684              <= Recv header: content-type: text/html; charset=UTF-8
21:38:40.341620 http.c:672              <= Recv header, 0000000290 bytes (0x00000122)
21:38:40.341622 http.c:684              <= Recv header: accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, S
ec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
21:38:40.341625 http.c:672              <= Recv header, 0000000025 bytes (0x00000019)
21:38:40.341627 http.c:684              <= Recv header: cf-mitigated: challenge
21:38:40.341629 http.c:672              <= Recv header, 0000000292 bytes (0x00000124)
21:38:40.341631 http.c:684              <= Recv header: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version,
 Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
21:38:40.341634 http.c:672              <= Recv header, 0000000044 bytes (0x0000002c)
21:38:40.341635 http.c:684              <= Recv header: cross-origin-embedder-policy: require-corp
21:38:40.341637 http.c:672              <= Recv header, 0000000041 bytes (0x00000029)
21:38:40.341638 http.c:684              <= Recv header: cross-origin-opener-policy: same-origin
21:38:40.341640 http.c:672              <= Recv header, 0000000043 bytes (0x0000002b)
21:38:40.341642 http.c:684              <= Recv header: cross-origin-resource-policy: same-origin
21:38:40.341644 http.c:672              <= Recv header, 0000000026 bytes (0x0000001a)
21:38:40.341645 http.c:684              <= Recv header: origin-agent-cluster: ?1
21:38:40.341647 http.c:672              <= Recv header, 0000000277 bytes (0x00000115)
21:38:40.341649 http.c:684              <= Recv header: permissions-policy: accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid
=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
21:38:40.341652 http.c:672              <= Recv header, 0000000030 bytes (0x0000001e)
21:38:40.341653 http.c:684              <= Recv header: referrer-policy: same-origin
21:38:40.341655 http.c:672              <= Recv header, 0000000047 bytes (0x0000002f)
21:38:40.341657 http.c:684              <= Recv header: server-timing: chlray;desc="9e8c2e3a0ffe1d0c"
21:38:40.341659 http.c:672              <= Recv header, 0000000033 bytes (0x00000021)
21:38:40.341660 http.c:684              <= Recv header: x-content-type-options: nosniff
21:38:40.341662 http.c:672              <= Recv header, 0000000029 bytes (0x0000001d)
21:38:40.341663 http.c:684              <= Recv header: x-frame-options: SAMEORIGIN
21:38:40.341671 http.c:672              <= Recv header, 0000000024 bytes (0x00000018)
21:38:40.341673 http.c:684              <= Recv header: content-encoding: gzip
21:38:40.341675 http.c:672              <= Recv header, 0000000020 bytes (0x00000014)
21:38:40.341676 http.c:684              <= Recv header: server: cloudflare
21:38:40.341678 http.c:672              <= Recv header, 0000000030 bytes (0x0000001e)
21:38:40.341680 http.c:684              <= Recv header: cf-ray: 9e8c2e3a0ffe1d0c-FRA
21:38:40.341682 http.c:672              <= Recv header, 0000000002 bytes (0x00000002)
21:38:40.341683 http.c:684              <= Recv header:
21:38:40.341768 http.c:725              == Info: Connection #0 to host git.yoctoproject.org left intact
fatal: unable to access 'https://git.yoctoproject.org/git/meta-raspberrypi/': The requested URL returned error: 403

$ dig +short  git.yoctoproject.org
git.yoctoproject.org.cdn.cloudflare.net.────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
104.18.1.115
104.18.0.115


This is happening from a server at Hetzner which is running behind the following IP which has a good reputation: https://www.projecthoneypot.org/ip_65.109.106.90


The same command from other machine behind a residential connection works.