admin/dyolink
0
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

Fix Ci/Cd: Get Node another way — try Gitea cache, then Arvan / AWS / GCR, and only then Docker Hub; once pulled, store it on Gitea for next time. #74

Merged
admin merged 6 commits from feature/ci-cd into master 2026-09-05 23:00:32 +03:30
Conversation 1 Commits 6 Files Changed 6 +66 -37
3 changed files with 66 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 663eafa3e8 - Show all commits

40
.gitea/workflows/prod-tag-deploy.yml
View File

@@ -44,8 +44,6 @@ defaults:
jobs: jobs:
build-and-push: build-and-push:
runs-on: windows runs-on: windows
outputs:
image_tag: ${{ steps.meta.outputs.image_tag }}
steps: steps:
- name: Checkout (this Gitea) - name: Checkout (this Gitea)
run: | run: |
@@ -75,6 +73,7 @@ jobs:
} }
$env:GIT_TERMINAL_PROMPT = '0' $env:GIT_TERMINAL_PROMPT = '0'
git clone --depth 1 --branch $Branch $cloneUrl . git clone --depth 1 --branch $Branch $cloneUrl .
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Resolve image tag (v*.*.* only) - name: Resolve image tag (v*.*.* only)
id: meta id: meta
@@ -90,10 +89,7 @@ jobs:
Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)" Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
exit 1 exit 1
} }
$utf8 = New-Object System.Text.UTF8Encoding $false
[System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}" $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix" Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
- name: Log in to container registry - name: Log in to container registry
@@ -103,13 +99,19 @@ jobs:
${{ secrets.REGISTRY_PASSWORD }} ${{ secrets.REGISTRY_PASSWORD }}
'@ '@
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Build and push backend (tag only, not :latest) - name: Build and push backend (tag only, not :latest)
run: | run: |
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
$tag = "${{ steps.meta.outputs.image_tag }}" $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag" $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
Write-Host "Building $prefix/dyolink-backend:$tag"
docker build -t "$prefix/dyolink-backend:$tag" ./backend
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$prefix/dyolink-backend:$tag"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Build and push frontend (nudentic.ir baked in) - name: Build and push frontend (nudentic.ir baked in)
env: env:
@@ -117,19 +119,24 @@ jobs:
NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }} NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
run: | run: |
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
$tag = "${{ steps.meta.outputs.image_tag }}" $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
$base = $env:PROD_PUBLIC_BASE_URL.Trim() $base = $env:PROD_PUBLIC_BASE_URL.Trim()
if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' } if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
$base = $base.TrimEnd('/') $base = $base.TrimEnd('/')
Write-Host "Building $prefix/dyolink-frontend:$tag"
docker build ` docker build `
--build-arg "NEXT_PUBLIC_API_URL=$base/api" ` --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
--build-arg "NEXT_PUBLIC_APP_URL=$base" ` --build-arg "NEXT_PUBLIC_APP_URL=$base" `
--build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" ` --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
--build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" ` --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
--build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" ` --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
-t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" ` -t "$prefix/dyolink-frontend:$tag" `
./frontend ./frontend
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$prefix/dyolink-frontend:$tag"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
deploy: deploy:
needs: build-and-push needs: build-and-push
@@ -163,6 +170,7 @@ jobs:
} }
$env:GIT_TERMINAL_PROMPT = '0' $env:GIT_TERMINAL_PROMPT = '0'
git clone --depth 1 --branch $Branch $cloneUrl . git clone --depth 1 --branch $Branch $cloneUrl .
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Write SSH key - name: Write SSH key
run: | run: |
@@ -193,19 +201,25 @@ jobs:
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' } if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new') $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts $infra/nginx" ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts $infra/nginx"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
scp.exe @ssh -P $port ` scp.exe @ssh -P $port `
infrastructure/docker-compose.prod.yml ` infrastructure/docker-compose.prod.yml `
"${user}@${hostName}:${infra}/docker-compose.prod.yml" "${user}@${hostName}:${infra}/docker-compose.prod.yml"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
scp.exe @ssh -P $port ` scp.exe @ssh -P $port `
infrastructure/scripts/prod-remote-deploy.sh ` infrastructure/scripts/prod-remote-deploy.sh `
"${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh" "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
scp.exe @ssh -P $port ` scp.exe @ssh -P $port `
infrastructure/scripts/render-nginx-ssl.sh ` infrastructure/scripts/render-nginx-ssl.sh `
"${user}@${hostName}:${infra}/scripts/render-nginx-ssl.sh" "${user}@${hostName}:${infra}/scripts/render-nginx-ssl.sh"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
scp.exe @ssh -P $port ` scp.exe @ssh -P $port `
infrastructure/nginx/nginx.ssl.conf.template ` infrastructure/nginx/nginx.ssl.conf.template `
"${user}@${hostName}:${infra}/nginx/nginx.ssl.conf.template" "${user}@${hostName}:${infra}/nginx/nginx.ssl.conf.template"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh $infra/scripts/render-nginx-ssl.sh" ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh $infra/scripts/render-nginx-ssl.sh"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Login on Linux and deploy tag - name: Login on Linux and deploy tag
run: | run: |
@@ -218,7 +232,8 @@ jobs:
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' } if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
$regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim() $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' } if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
$tag = "${{ needs.build-and-push.outputs.image_tag }}" $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
$pass = @' $pass = @'
${{ secrets.REGISTRY_PASSWORD }} ${{ secrets.REGISTRY_PASSWORD }}
'@ '@
@@ -226,3 +241,4 @@ jobs:
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new') $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
$remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag" $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
$pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

62
.gitea/workflows/registry-build-deploy.yml
View File

@@ -33,6 +33,7 @@
# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"] # Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
# #
# Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner). # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
# Windows PowerShell 5.1 does not fail a step when docker/git return non-zero — always check $LASTEXITCODE.
name: Registry — build, push, deploy name: Registry — build, push, deploy
@@ -48,8 +49,6 @@ defaults:
jobs: jobs:
build-and-push: build-and-push:
runs-on: windows runs-on: windows
outputs:
image_tag: ${{ steps.meta.outputs.image_tag }}
steps: steps:
- name: Checkout (clone from this Gitea — no gitea.com) - name: Checkout (clone from this Gitea — no gitea.com)
run: | run: |
@@ -74,16 +73,7 @@ jobs:
} }
$env:GIT_TERMINAL_PROMPT = '0' $env:GIT_TERMINAL_PROMPT = '0'
git clone --depth 1 --branch $Branch $cloneUrl . git clone --depth 1 --branch $Branch $cloneUrl .
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Image tag and registry prefix
id: meta
run: |
$ErrorActionPreference = 'Stop'
$short = (git rev-parse --short HEAD).Trim()
$utf8 = New-Object System.Text.UTF8Encoding $false
[System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
- name: Log in to container registry - name: Log in to container registry
run: | run: |
@@ -92,17 +82,27 @@ jobs:
${{ secrets.REGISTRY_PASSWORD }} ${{ secrets.REGISTRY_PASSWORD }}
'@ '@
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Build and push backend - name: Build and push backend
run: | run: |
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
$tag = "${{ steps.meta.outputs.image_tag }}" $tag = "${{ github.sha }}".Substring(0, 7)
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
if ([string]::IsNullOrWhiteSpace($tag) -or [string]::IsNullOrWhiteSpace($prefix)) {
Write-Host "Missing github.sha, REGISTRY_HOST, or REGISTRY_OWNER"
exit 1
}
Write-Host "Building $prefix/dyolink-backend:$tag"
docker build ` docker build `
-t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ` -t "$prefix/dyolink-backend:$tag" `
-t "$env:REGISTRY_PREFIX/dyolink-backend:latest" ` -t "$prefix/dyolink-backend:latest" `
./backend ./backend
docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag" if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest" docker push "$prefix/dyolink-backend:$tag"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$prefix/dyolink-backend:latest"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Build and push frontend - name: Build and push frontend
env: env:
@@ -110,19 +110,24 @@ jobs:
NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }} NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
run: | run: |
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
$tag = "${{ steps.meta.outputs.image_tag }}" $tag = "${{ github.sha }}".Substring(0, 7)
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
$base = $env:PUBLIC_BASE_URL $base = $env:PUBLIC_BASE_URL
Write-Host "Building $prefix/dyolink-frontend:$tag"
docker build ` docker build `
--build-arg "NEXT_PUBLIC_API_URL=$base/api" ` --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
--build-arg "NEXT_PUBLIC_APP_URL=$base" ` --build-arg "NEXT_PUBLIC_APP_URL=$base" `
--build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" ` --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
--build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" ` --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
--build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" ` --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
-t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" ` -t "$prefix/dyolink-frontend:$tag" `
-t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" ` -t "$prefix/dyolink-frontend:latest" `
./frontend ./frontend
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest" docker push "$prefix/dyolink-frontend:$tag"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker push "$prefix/dyolink-frontend:latest"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
deploy: deploy:
needs: build-and-push needs: build-and-push
@@ -151,6 +156,7 @@ jobs:
} }
$env:GIT_TERMINAL_PROMPT = '0' $env:GIT_TERMINAL_PROMPT = '0'
git clone --depth 1 --branch $Branch $cloneUrl . git clone --depth 1 --branch $Branch $cloneUrl .
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Write deploy.registry.env and validate secrets path - name: Write deploy.registry.env and validate secrets path
run: | run: |
@@ -173,16 +179,19 @@ jobs:
if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' } if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
$localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim() $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' } if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
$imageTag = "${{ needs.build-and-push.outputs.image_tag }}" $imageTag = "${{ github.sha }}".Substring(0, 7)
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
Write-Host "IMAGE_TAG=$imageTag REGISTRY_PREFIX=$prefix"
$lines = @( $lines = @(
"REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}", "REGISTRY_PREFIX=$prefix",
"IMAGE_TAG=$imageTag", "IMAGE_TAG=$imageTag",
"STAGING_HTTP_PORT=$stagingPort", "STAGING_HTTP_PORT=$stagingPort",
"STAGING_LOCAL_PORT=$localPort", "STAGING_LOCAL_PORT=$localPort",
"DEPLOY_SECRETS_DIR=$SD" "DEPLOY_SECRETS_DIR=$SD"
) )
Set-Location infrastructure Set-Location infrastructure
$lines | Set-Content -Path deploy.registry.env -Encoding utf8 $utf8 = New-Object System.Text.UTF8Encoding $false
[System.IO.File]::WriteAllText((Join-Path (Get-Location) 'deploy.registry.env'), ($lines -join "`n") + "`n", $utf8)
- name: Log in to container registry (for pull) - name: Log in to container registry (for pull)
run: | run: |
@@ -191,10 +200,13 @@ jobs:
${{ secrets.REGISTRY_PASSWORD }} ${{ secrets.REGISTRY_PASSWORD }}
'@ '@
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
- name: Pull and start stack - name: Pull and start stack
run: | run: |
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
Set-Location infrastructure Set-Location infrastructure
docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

1
infrastructure/STAGING-DEPLOY.md
View File

@@ -300,6 +300,7 @@ On the Windows host, from repo `infrastructure/`:
| Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` | | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
| Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` | | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
| `413 Request Entity Too Large` on `docker push` to `https://gitea.wixur.ir/v2/…/blobs/uploads` | Nginx (or Cloudflare) in front of Gitea is rejecting the image layer. **Fix the proxy** (then `nginx -s reload`): in the `server { server_name gitea.wixur.ir; }` block set `client_max_body_size 0;` and `proxy_request_buffering off;` — snippet: [`nginx/windows-gitea.wixur.snippet.conf`](nginx/windows-gitea.wixur.snippet.conf). **Or skip the proxy:** set `REGISTRY_HOST=host.docker.internal:3000` (and Gitea `ROOT_URL`) so CI pushes to `:3000`. If the hostname is orange-clouded on Cloudflare, grey-cloud it (free plan caps uploads at 100MB). | | `413 Request Entity Too Large` on `docker push` to `https://gitea.wixur.ir/v2/…/blobs/uploads` | Nginx (or Cloudflare) in front of Gitea is rejecting the image layer. **Fix the proxy** (then `nginx -s reload`): in the `server { server_name gitea.wixur.ir; }` block set `client_max_body_size 0;` and `proxy_request_buffering off;` — snippet: [`nginx/windows-gitea.wixur.snippet.conf`](nginx/windows-gitea.wixur.snippet.conf). **Or skip the proxy:** set `REGISTRY_HOST=host.docker.internal:3000` (and Gitea `ROOT_URL`) so CI pushes to `:3000`. If the hostname is orange-clouded on Cloudflare, grey-cloud it (free plan caps uploads at 100MB). |
| `…-backend:<sha>: not found` / `…-frontend:<sha>: not found` on compose pull | Images were never pushed. `build-and-push` can look green in ~40s because Windows PowerShell ignores `docker` exit codes — check that job’s **Build and push** logs for a real `docker build`/`docker push` failure (often 413 via `gitea.wixur.ir`). Confirm the SHA tag exists under Gitea **Packages**. Prefer `REGISTRY_HOST=host.docker.internal:3000`. Re-run the workflow after the push actually succeeds. |
| `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. | | `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
| `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). | | `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
| `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker | | `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |