docs: imaget hentes fra GHCR, og prøven for 'offentlig' var forkert

Adressen rettet fem steder tilbage til ghcr.io. Og rune-siden lærte folk at
teste synlighed med `docker --config /tmp/empty pull`, hvilket er den fejl,
der tog instansen ned: en tom config stopper ikke maskinens credential-helper,
så pullet autentificeres uden at se sådan ud og melder succes for et image,
ingen fremmed kan hente. Prøven er nu registrets token-endepunkt med curl.

README.md

@@ -171,7 +171,7 @@ docker run -d --name verdande \
   -p 8080:8080 \
   -v verdande-data:/data \
   -e VERDANDE_BASE_URL=https://todo.example.dk \
-  gitea.nolimit.dk/kw/verdande:latest
+  ghcr.io/kristianwind/verdande:latest
 ```
 
 ### From source

docs/index.md

@@ -72,7 +72,7 @@ docker run -d --name verdande \
   -p 8080:8080 \
   -v verdande-data:/data \
   -e VERDANDE_BASE_URL=https://todo.example.dk \
-  gitea.nolimit.dk/kw/verdande:latest
+  ghcr.io/kristianwind/verdande:latest
 ```
 
 Open the address, create the first account — that account is the administrator.

docs/rune.md

@@ -24,21 +24,28 @@ looks locally — then reports the image as missing.
     sends them itself with each request. Yggdrasil is a different client and
     sends none, so logging in changes nothing for the panel.
 
-**The package has to be readable without credentials.** On Gitea that does not
+**The package has to be readable without credentials**, and the only way to know
-mean making the source repository public: a container package is only tied to a
+is to ask the registry for a token as a stranger:
-repository when it is pushed with a repository link, and this one is not — so its
-visibility follows the account, which is public, while `kw/verdande` stays
-private.
-
-Check it the way a puller does, with no credentials at all:
 
 ```bash
-docker --config /tmp/empty pull gitea.nolimit.dk/kw/verdande:latest
+curl -s "https://ghcr.io/token?scope=repository:kristianwind/verdande:pull&service=ghcr.io"
 ```
 
-If that works, the panel can pull it. A plain `curl` against `/v2/…/manifests/…`
+A 200 with a `token` in it means anyone can pull, which means the panel can. A
-answers 401 even for a readable image — the registry hands out an anonymous token
+401 means it cannot, whatever the package page says.
-first — so a bare curl is not the test.
+
+!!! danger "Do not test this with `docker --config /tmp/empty pull`"
+    It looks like the honest test and is not. An empty config directory does not
+    stop the machine's credential helper, so the pull is quietly authenticated
+    with credentials you forgot you had — and reports success for an image no
+    stranger can fetch. This cost a production instance an hour of downtime: the
+    image was declared public on that evidence, the rune was pointed at it, and
+    the host — which had never logged in — could not pull a thing.
+
+    A self-hosted Gitea is where this bites. An instance with `REQUIRE_SIGNIN_VIEW`
+    turned on refuses anonymous tokens for its registry too, and no per-package
+    setting overrides it. Making the source repository public does not change it
+    either; that was tried.
 
 Once it is public, press **Start** on the server you already have. There is no
 need to delete it and make another: the image reference is read from the rune at

docs/self-hosting.md

@@ -19,7 +19,7 @@ docker run -d --name verdande \
   -p 8080:8080 \
   -v verdande-data:/data \
   -e VERDANDE_BASE_URL=https://todo.example.dk \
-  gitea.nolimit.dk/kw/verdande:latest
+  ghcr.io/kristianwind/verdande:latest
 ```
 
 `VERDANDE_BASE_URL` has to be the address you actually reach it on. Invite links,
@@ -31,7 +31,7 @@ means the links in your email point somewhere that does not answer.
 ```yaml
 services:
   verdande:
-    image: gitea.nolimit.dk/kw/verdande:latest
+    image: ghcr.io/kristianwind/verdande:latest
     restart: unless-stopped
     ports:
       - "8080:8080"

site/index.html

@@ -1238,7 +1238,7 @@
   -p 8080:8080 \
   -v verdande-data:/data \
   -e VERDANDE_BASE_URL=https://todo.example.dk \
-  gitea.nolimit.dk/kw/verdande:latest</code></pre>
+  ghcr.io/kristianwind/verdande:latest</code></pre>
 					</div>
 				</div>