push with a write:package token, not the Actions token

Second build failed the same way: docker login to this instance's registry
returns "unauthorized" for the automatic Actions token, and declaring
permissions: packages: write did not change it -- Gitea's task token is accepted
by the API but not by the package registry.

So the push uses REGISTRY_TOKEN, an org secret holding a personal access token
scoped to write:package and nothing else. The step fails with that sentence in
the log rather than another bare "unauthorized", because the difference
between a missing secret and a rejected credential is not visible from the
error docker prints.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx

.gitea/workflows/docker.yml

@@ -0,0 +1,59 @@
+name: Docker
+# Builds the hosted-gateway image for the homelab instance and pushes it to this
+# Gitea's own registry. Deliberately build-only: the GitHub workflow this
+# replaces also SSHed into the Hostinger VPS and redeployed it, which is the
+# machine being retired. Here the image is deployed the way everything else in
+# the homelab is -- a PR bumping the tag in ffaerber/homelab's docker-compose.yml
+# -- so a deploy is a reviewed commit rather than a side effect of a push.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    # The homelab runner (a container on pluto, sharing the host docker daemon).
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      # Plain docker rather than buildx: the runner already has the host daemon
+      # on a mounted socket, and the gha cache backend buildx wants does not
+      # exist here.
+      - name: Build
+        run: |
+          set -eu
+          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway" >> "$GITHUB_ENV"
+          echo "SHA=$SHA" >> "$GITHUB_ENV"
+          docker build --build-arg COMMIT_SHA=${{ github.sha }} \
+            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway:$SHA" .
+
+      # Pull requests build to prove the Dockerfile still works, and stop there.
+      - name: Push
+        if: github.event_name != 'pull_request'
+        run: |
+          set -eu
+          # Not the automatic Actions token: this Gitea's package registry rejects
+          # it (docker login returns a bare "unauthorized"), with or without a
+          # permissions: packages: write block. REGISTRY_TOKEN is an org secret
+          # holding a personal access token scoped to write:package only.
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "REGISTRY_TOKEN is not set — create a token with the write:package scope" >&2
+            echo "and add it as an org secret on token-for-token. The image built fine;" >&2
+            echo "only the push needs it." >&2
+            exit 1
+          fi
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ vars.REGISTRY_USER || 'ffaerber' }}" --password-stdin
+          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
+          docker push "$IMAGE:$SHA"
+          docker push "$IMAGE:latest"
+          docker logout git.ffaerber.duckdns.org
+          {
+            echo "### Pushed"
+            echo
+            echo '```'
+            echo "$IMAGE:$SHA"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docker.yml

@@ -1,60 +0,0 @@
-name: Docker Image
-
-on:
-  push:
-    branches: [main, develop]
-  pull_request:
-    branches: [main]
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: docker/metadata-action@v5
-        id: meta
-        with:
-          images: ghcr.io/token-for-token/hosted-gateway
-          tags: |
-            type=sha
-            type=ref,event=branch
-            type=raw,value=latest,enable={{is_default_branch}}
-          labels: |
-            org.opencontainers.image.source=https://github.com/token-for-token/hosted-gateway
-
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            COMMIT_SHA=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: docker stack deploy
-        if: github.event_name != 'pull_request'
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          username: root
-          host: ${{ secrets.SSH_KNOWN_HOSTS }}
-          key: ${{ secrets.SSH_PRIV_KEY }}
-          script: |
-            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-            docker pull ghcr.io/token-for-token/hosted-gateway:main
-            docker stack deploy -c ~/devops/hostinger/prod-stack.yaml prod --with-registry-auth --resolve-image always
-            docker image prune -f --filter "until=24h"