rock/riotpiao.com
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use env vars for docker registry credentials #3

Merged
rock merged 5 commits from fix/registry-login-env into main 2026-09-07 07:08:38 +00:00
Conversation 0 Commits 5 Files Changed 5
+51 -14
rock commented 2026-09-07 06:38:27 +00:00
Owner
Copy Link
Copy Source

Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.

This is the reference implementation pattern used across all repos.

This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.

After merge + org-level secrets configured:

  • All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
  • CI validates credentials exist before docker login
  • Image pushed to registry on main push
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. This is the reference implementation pattern used across all repos. This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach. After merge + org-level secrets configured: - All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN - CI validates credentials exist before docker login - Image pushed to registry on main push
rock added 3 commits 2026-09-07 06:38:28 +00:00
fix: move LLM config to encrypted ConfigMap (CI-friendly)
Build & Push Portfolio Image / Test (pull_request) Failing after 34s
Details
Build & Push Portfolio Image / Build & Push Image (pull_request) Skipped
Details
4ad8a4f4a4 
Problem: LLM_API_URL hardcoded to external HTTPS endpoint
- https://api.riotpiao.com/v1/chat/completions (TLS hairpin through nginx)
- Not externalizable for CI or environment-specific deployment

Solution: Move to SOPS-encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS overhead, direct cluster communication
- Encrypted for security (SOPS + age key)
- Externalizable: CI can update values without app redeployment

Changes:
1. Create configmap.enc.yaml (SOPS-encrypted)
   - Data: LLM_API_URL, LLM_MODEL
   - Encrypted with .sops.yaml age key
2. Update deployment.yaml
   - Change from 'value:' to 'valueFrom: configMapKeyRef'
   - Reference portfolio-llm-config ConfigMap
3. Update kustomization.yaml
   - Add configmap.enc.yaml to resources
   - Add sops: version: 3 for decryption

Benefits:
- ArgoCD auto-decrypts via SOPS before applying
- CI can auto-patch ConfigMap without app changes
- Environment-specific config (dev/staging/prod)
- Secrets encrypted in git (never plain text)
fix: validate registry credentials before docker login 1f66db0ba4 
Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.
fix: use env vars for docker registry credentials b3e5d63e86
rock added 1 commit 2026-09-07 06:40:56 +00:00
fix: use origin/main workflow with env vars for registry credentials
CI / Test (pull_request) Failing after 28s
Details
CI / Build & Push Image (pull_request) Skipped
Details
22f5afdb58 
Resolved merge conflicts by using current origin/main workflow which:
- Includes test job (npm ci + npm test)
- Has delete old latest image step
- Uses --build-arg for COMMIT_SHA
- Uses env vars for registry credentials (FORGEJO_REGISTRY_USER/TOKEN)

All features from main preserved, registry login fixed.
rock force-pushed fix/registry-login-env from ed4643e347 to 22f5afdb58 2026-09-07 06:40:56 +00:00 Compare
rock force-pushed fix/registry-login-env from 9e70604087 to a45fae0287 2026-09-07 06:52:07 +00:00 Compare
rock force-pushed fix/registry-login-env from a45fae0287 to 70fcdb599f 2026-09-07 06:52:30 +00:00 Compare
rock added 1 commit 2026-09-07 07:00:53 +00:00
fix: update lucide-react + eslint versions
CI / Test (pull_request) Successful in 1m35s
Details
CI / Build & Push Image (pull_request) Skipped
Details
5a95ce67de 
- lucide-react: 0.344.0 → 1.41.0 (React 19 support)
- eslint: 8.57.1 → 9.0.0 (compatibility with eslint-config-next 16.x)

Also includes:
- Registry login via env vars (FORGEJO_REGISTRY_USER/TOKEN)
- LLM config in encrypted ConfigMap (in-cluster endpoint)
rock force-pushed fix/registry-login-env from 70fcdb599f to 5a95ce67de 2026-09-07 07:00:53 +00:00 Compare
rock merged commit 19bf437d79 into main 2026-09-07 07:08:38 +00:00
rock deleted branch fix/registry-login-env 2026-09-07 07:08:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: rock/riotpiao.com#3