From 3e8d60931681665d5a8f932b468e31bdf395dd48 Mon Sep 17 00:00:00 2001 From: Kristian Wind Date: Sat, 22 Aug 2026 00:29:57 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20imaget=20hentes=20fra=20GHCR,=20og=20pr?= =?UTF-8?q?=C3=B8ven=20for=20'offentlig'=20var=20forkert?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adressen rettet fem steder tilbage til ghcr.io. Og rune-siden lærte folk at teste synlighed med `docker --config /tmp/empty pull`, hvilket er den fejl, der tog instansen ned: en tom config stopper ikke maskinens credential-helper, så pullet autentificeres uden at se sådan ud og melder succes for et image, ingen fremmed kan hente. Prøven er nu registrets token-endepunkt med curl. --- README.md | 2 +- docs/index.md | 2 +- docs/rune.md | 29 ++++++++++++++++++----------- docs/self-hosting.md | 4 ++-- site/index.html | 2 +- 5 files changed, 23 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index d6a0f39..b4f5994 100644 --- a/README.md +++ b/README.md @@ -171,7 +171,7 @@ docker run -d --name verdande \ -p 8080:8080 \ -v verdande-data:/data \ -e VERDANDE_BASE_URL=https://todo.example.dk \ - gitea.nolimit.dk/kw/verdande:latest + ghcr.io/kristianwind/verdande:latest ``` ### From source diff --git a/docs/index.md b/docs/index.md index 097a7da..e6e8da6 100644 --- a/docs/index.md +++ b/docs/index.md @@ -72,7 +72,7 @@ docker run -d --name verdande \ -p 8080:8080 \ -v verdande-data:/data \ -e VERDANDE_BASE_URL=https://todo.example.dk \ - gitea.nolimit.dk/kw/verdande:latest + ghcr.io/kristianwind/verdande:latest ``` Open the address, create the first account — that account is the administrator. diff --git a/docs/rune.md b/docs/rune.md index b1221a8..76900b5 100644 --- a/docs/rune.md +++ b/docs/rune.md @@ -24,21 +24,28 @@ looks locally — then reports the image as missing. sends them itself with each request. Yggdrasil is a different client and sends none, so logging in changes nothing for the panel. -**The package has to be readable without credentials.** On Gitea that does not -mean making the source repository public: a container package is only tied to a -repository when it is pushed with a repository link, and this one is not — so its -visibility follows the account, which is public, while `kw/verdande` stays -private. - -Check it the way a puller does, with no credentials at all: +**The package has to be readable without credentials**, and the only way to know +is to ask the registry for a token as a stranger: ```bash -docker --config /tmp/empty pull gitea.nolimit.dk/kw/verdande:latest +curl -s "https://ghcr.io/token?scope=repository:kristianwind/verdande:pull&service=ghcr.io" ``` -If that works, the panel can pull it. A plain `curl` against `/v2/…/manifests/…` -answers 401 even for a readable image — the registry hands out an anonymous token -first — so a bare curl is not the test. +A 200 with a `token` in it means anyone can pull, which means the panel can. A +401 means it cannot, whatever the package page says. + +!!! danger "Do not test this with `docker --config /tmp/empty pull`" + It looks like the honest test and is not. An empty config directory does not + stop the machine's credential helper, so the pull is quietly authenticated + with credentials you forgot you had — and reports success for an image no + stranger can fetch. This cost a production instance an hour of downtime: the + image was declared public on that evidence, the rune was pointed at it, and + the host — which had never logged in — could not pull a thing. + + A self-hosted Gitea is where this bites. An instance with `REQUIRE_SIGNIN_VIEW` + turned on refuses anonymous tokens for its registry too, and no per-package + setting overrides it. Making the source repository public does not change it + either; that was tried. Once it is public, press **Start** on the server you already have. There is no need to delete it and make another: the image reference is read from the rune at diff --git a/docs/self-hosting.md b/docs/self-hosting.md index 9ca5183..122dc59 100644 --- a/docs/self-hosting.md +++ b/docs/self-hosting.md @@ -19,7 +19,7 @@ docker run -d --name verdande \ -p 8080:8080 \ -v verdande-data:/data \ -e VERDANDE_BASE_URL=https://todo.example.dk \ - gitea.nolimit.dk/kw/verdande:latest + ghcr.io/kristianwind/verdande:latest ``` `VERDANDE_BASE_URL` has to be the address you actually reach it on. Invite links, @@ -31,7 +31,7 @@ means the links in your email point somewhere that does not answer. ```yaml services: verdande: - image: gitea.nolimit.dk/kw/verdande:latest + image: ghcr.io/kristianwind/verdande:latest restart: unless-stopped ports: - "8080:8080" diff --git a/site/index.html b/site/index.html index 05865f3..2e7a0cc 100644 --- a/site/index.html +++ b/site/index.html @@ -1238,7 +1238,7 @@ -p 8080:8080 \ -v verdande-data:/data \ -e VERDANDE_BASE_URL=https://todo.example.dk \ - gitea.nolimit.dk/kw/verdande:latest + ghcr.io/kristianwind/verdande:latest