3 Commits

Include renames

Author	SHA1	Message	Date
Felix FaerberandClaude Opus 5	e47e62780a	push with a write:package token, not the Actions token ... Second build failed the same way: docker login to this instance's registry returns "unauthorized" for the automatic Actions token, and declaring permissions: packages: write did not change it -- Gitea's task token is accepted by the API but not by the package registry. So the push uses REGISTRY_TOKEN, an org secret holding a personal access token scoped to write:package and nothing else. The step fails with that sentence in the log rather than another bare "unauthorized", because the difference between a missing secret and a rejected credential is not visible from the error docker prints. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx	2026-09-15 12:38:14 +03:00
Felix FaerberandClaude Opus 5	d6fc2477f3	declare packages: write so the registry login works ... The first build pushed nothing: `docker login git.ffaerber.duckdns.org` came back "unauthorized". Gitea scopes the automatic Actions token from the job's permissions block, and without one it has no package write -- so the build succeeded and the push failed on auth, which reads like a credential problem rather than a missing declaration. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx	2026-09-15 12:36:51 +03:00
Felix Faerber	6a54487ec1	build on Gitea, push to the Gitea registry ... This repo now lives on git.ffaerber.duckdns.org and its image is consumed by the homelab swarm, so the build moves with it: .gitea/workflows/docker.yml builds on the homelab runner and pushes to this Gitea's registry as an immutable short-SHA tag plus :latest. Build-only, on purpose. The GitHub workflow it replaces also SSHed into the Hostinger VPS and ran `docker stack deploy` on every push to main, which deploys the machine being retired and makes a deploy a side effect of a push. The homelab pattern is a PR bumping the tag in ffaerber/homelab, so shipping is a reviewed commit. Plain `docker build` rather than buildx: the runner shares the host daemon through a mounted socket, and buildx's gha cache backend does not exist outside GitHub. .github/workflows is removed from this copy so Gitea does not also try to run it -- it would log in to ghcr with a Gitea token and SSH to a host whose secrets are not here. The GitHub repository keeps its own copy untouched.	2026-09-15 12:30:07 +03:00