rock/riotpiao.com
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use env vars for docker registry credentials #3

Merged
rock merged 5 commits from fix/registry-login-env into main 2026-09-07 07:08:38 +00:00
Conversation 0 Commits 5 Files Changed 5
+51 -14
5 Commits
Author SHA1 Message Date
Story Crater Bot 5a95ce67de fix: update lucide-react + eslint versions
CI / Test (pull_request) Successful in 1m35s
Details
CI / Build & Push Image (pull_request) Skipped
Details 
- lucide-react: 0.344.0 → 1.41.0 (React 19 support)
- eslint: 8.57.1 → 9.0.0 (compatibility with eslint-config-next 16.x)

Also includes:
- Registry login via env vars (FORGEJO_REGISTRY_USER/TOKEN)
- LLM config in encrypted ConfigMap (in-cluster endpoint)
 2026-09-07 00:00:47 -07:00
Story Crater Bot 22f5afdb58 fix: use origin/main workflow with env vars for registry credentials
CI / Test (pull_request) Failing after 28s
Details
CI / Build & Push Image (pull_request) Skipped
Details 
Resolved merge conflicts by using current origin/main workflow which:
- Includes test job (npm ci + npm test)
- Has delete old latest image step
- Uses --build-arg for COMMIT_SHA
- Uses env vars for registry credentials (FORGEJO_REGISTRY_USER/TOKEN)

All features from main preserved, registry login fixed.
 2026-09-06 23:40:51 -07:00
Story Crater Bot b3e5d63e86 fix: use env vars for docker registry credentials 2026-09-06 23:37:56 -07:00
Story Crater Bot 1f66db0ba4 fix: validate registry credentials before docker login 
Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.
 2026-09-06 23:34:54 -07:00
Story Crater Bot 4ad8a4f4a4 fix: move LLM config to encrypted ConfigMap (CI-friendly)
Build & Push Portfolio Image / Test (pull_request) Failing after 34s
Details
Build & Push Portfolio Image / Build & Push Image (pull_request) Skipped
Details 
Problem: LLM_API_URL hardcoded to external HTTPS endpoint
- https://api.riotpiao.com/v1/chat/completions (TLS hairpin through nginx)
- Not externalizable for CI or environment-specific deployment

Solution: Move to SOPS-encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS overhead, direct cluster communication
- Encrypted for security (SOPS + age key)
- Externalizable: CI can update values without app redeployment

Changes:
1. Create configmap.enc.yaml (SOPS-encrypted)
   - Data: LLM_API_URL, LLM_MODEL
   - Encrypted with .sops.yaml age key
2. Update deployment.yaml
   - Change from 'value:' to 'valueFrom: configMapKeyRef'
   - Reference portfolio-llm-config ConfigMap
3. Update kustomization.yaml
   - Add configmap.enc.yaml to resources
   - Add sops: version: 3 for decryption

Benefits:
- ArgoCD auto-decrypts via SOPS before applying
- CI can auto-patch ConfigMap without app changes
- Environment-specific config (dev/staging/prod)
- Secrets encrypted in git (never plain text)
 2026-09-06 23:25:35 -07:00