Ref T10784. On secure, logged-out users currently can't browse repositories when cluster/service mode is enabled because they aren't permitted to make intracluster requests.
We don't allow totally public external requests (they're hard to rate limit and users might write bots that polled feed.query or whatever which we'd have no way to easily disable) but it's fine to allow intracluster public requests.