The first build pushed nothing: `docker login git.ffaerber.duckdns.org` came
back "unauthorized". Gitea scopes the automatic Actions token from the job's
permissions block, and without one it has no package write -- so the build
succeeded and the push failed on auth, which reads like a credential problem
rather than a missing declaration.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx
This repo now lives on git.ffaerber.duckdns.org and its image is consumed by the
homelab swarm, so the build moves with it: .gitea/workflows/docker.yml builds on
the homelab runner and pushes to this Gitea's registry as an immutable short-SHA
tag plus :latest.
Build-only, on purpose. The GitHub workflow it replaces also SSHed into the
Hostinger VPS and ran `docker stack deploy` on every push to main, which
deploys the machine being retired and makes a deploy a side effect of a push.
The homelab pattern is a PR bumping the tag in ffaerber/homelab, so shipping is
a reviewed commit.
Plain `docker build` rather than buildx: the runner shares the host daemon
through a mounted socket, and buildx's gha cache backend does not exist outside
GitHub.
.github/workflows is removed from this copy so Gitea does not also try to run
it -- it would log in to ghcr with a Gitea token and SSH to a host whose secrets
are not here. The GitHub repository keeps its own copy untouched.