docs: imaget hentes fra GHCR, og prøven for 'offentlig' var forkert

Adressen rettet fem steder tilbage til ghcr.io. Og rune-siden lærte folk at
teste synlighed med `docker --config /tmp/empty pull`, hvilket er den fejl,
der tog instansen ned: en tom config stopper ikke maskinens credential-helper,
så pullet autentificeres uden at se sådan ud og melder succes for et image,
ingen fremmed kan hente. Prøven er nu registrets token-endepunkt med curl.

.gitea/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,46 @@
+name: Bug
+# Gitea kalder feltet `about`, hvor GitHub kalder det `description`, og Gitea
+# *kræver* det: en skabelon uden bliver afvist frem for at blive vist. Derfor
+# ligger skabelonerne her for sig frem for at være delt med `.github/`.
+about: Something does not work
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: And what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: How to reproduce it
+      placeholder: |
+        1. …
+        2. …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The image tag, or the commit you built from.
+    validations:
+      required: true
+  - type: dropdown
+    id: how
+    attributes:
+      label: How are you running it
+      options:
+        - As a Rune in Yggdrasil Panel
+        - Docker directly
+        - From source
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Anything in the logs
+      description: Please remove tokens and email addresses first.
+      render: text

.gitea/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issue
+    url: https://gitea.nolimit.dk/kw/verdande/src/branch/main/SECURITY.md
+    about: Please report vulnerabilities by email, not as a public issue.

.gitea/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,24 @@
+name: Feature
+about: Suggest something
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      # Absolut adresse, ikke GitHubs `../../blob/main/…`: Gitea lægger en fil
+      # under `/src/branch/<gren>/`, så den relative form peger ingen steder her.
+      value: |
+        Please check the [non-goals](https://gitea.nolimit.dk/kw/verdande/src/branch/main/README.md#non-goals)
+        first — some things are deliberately not being built.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do
+      description: The problem, not the solution. What does the current version make hard?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you had in mind
+    validations:
+      required: false

.gitea/workflows/ci.yml

@@ -0,0 +1,273 @@
+name: CI
+
+# Gitea-tvillingen til .github/workflows/ci.yml. Den prøver at nå samme resultat
+# ad en anden vej, og forskellen er hele pointen med filen:
+#
+# INGEN `uses:`. Gitea Actions kan læse GitHubs format, men `DEFAULT_ACTIONS_URL`
+# står ikke i app.ini på gitea.nolimit.dk, og standarden er github.com — så et
+# `uses: actions/checkout@v4` her ville blive hentet FRA GitHub, hver gang, også
+# selvom både koden, runneren og registret er vores egne. Et workflow, der bruger
+# markedspladsen, er derfor ikke uafhængigt af GitHub; det ser bare sådan ud.
+#
+# Prisen er, at værktøjskæden skal komme et sted fra. Den kommer fra jobbets
+# container, hvilket er billigere end det lyder: `container: golang:1.26` er
+# nøjagtig det, setup-go ellers ville bruge et trin på at installere.
+#
+# Alternativerne, hvis nogen senere vil skrive filen om: sæt DEFAULT_ACTIONS_URL
+# til gitea.com, som spejler de gængse handlinger — men det flytter kun
+# afhængigheden fra én andens server til en andens, og det er en indstilling for
+# HELE instansen, altså også for alt andet, der bygger der. Denne fil rører kun
+# dette repo.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Så en kørsel kan udløses uden at skulle opfinde en commit. Det er ikke
+  # bekvemmelighed: uden den er den eneste måde at få CI til at køre igen mod
+  # uændret kode at skubbe noget tomt, og en tom commit i historikken er en
+  # løgn om, at der skete noget.
+  workflow_dispatch:
+
+# Ingen `concurrency:`-blok. GitHub-udgaven aflyser en kørsel, når en nyere
+# kommer, og det er stadig det rigtige at gøre — men understøttelsen kom sent til
+# Gitea Actions, og et felt, runneren ikke kender, er en fejl ved oversættelsen
+# frem for en ignoreret linje. Den kan sættes på, når instansen er en version,
+# der kan.
+
+jobs:
+  go:
+    name: Go
+    runs-on: ubuntu-latest
+    # Containeren ER værktøjskæden. `-race` kræver en C-oversætter, og den er med
+    # i det officielle golang-image — et slankere ville koste et apt-trin.
+    container:
+      image: golang:1.26
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          # Håndrullet, fordi actions/checkout ville blive hentet fra GitHub.
+          # Det er de samme fire greb, den handling tager: init, remote, en
+          # fetch af præcis den commit, der udløste kørslen, og et checkout.
+          #
+          # Legitimationen sættes med -c på selve fetch-kommandoen frem for i
+          # remotens adresse. En adresse med token i havner i .git/config, i
+          # `git remote -v` og i enhver fejlbesked, der citerer den; en header
+          # gør ikke.
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "These files are not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # -race is the whole point of running tests in CI for a server with a
+      # WebSocket fan-out: a data race is exactly the bug that passes locally.
+      - name: Test
+        run: go test -race -count=1 ./...
+
+      - name: Build
+        run: CGO_ENABLED=0 go build ./...
+
+  spec:
+    name: OpenAPI is valid
+    runs-on: ubuntu-latest
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Structural validity only. That the spec matches the *router* is checked by
+      # a Go test, which is the half that actually goes stale.
+      - run: npx --yes @redocly/cli@latest lint docs/openapi.yaml
+
+  e2e:
+    name: End-to-end
+    runs-on: ubuntu-latest
+    # node frem for golang her: Playwrights browsere trækker et lag
+    # Debian-pakker, som npm-imaget er vant til at have, mens Go til gengæld er
+    # fire linjer at hælde ind. Den anden vej rundt er den dyre.
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Go
+        run: |
+          set -eu
+          # Versionen læses ud af go.mod frem for at stå her. To steder at rette
+          # er ét for mange, og den slags glemmes lige indtil CI bygger med en
+          # anden Go end udviklerne.
+          version=$(awk '/^go /{print $2; exit}' go.mod)
+          arch=$(dpkg --print-architecture)
+          curl -fsSL "https://go.dev/dl/go${version}.linux-${arch}.tar.gz" | tar -xz -C /usr/local
+          echo /usr/local/go/bin >> "$GITHUB_PATH"
+
+      - name: Install
+        working-directory: web
+        run: npm ci --no-audit --no-fund
+
+      # Chromium for the suite, WebKit for one test.
+      #
+      # A smoke test exists to catch a build that does not work at all, and running
+      # the whole thing in three engines finds the same breakage three times for
+      # three times the cost. Focus is the exception, and it took a real report to
+      # learn it: Safari ignores `autofocus` on anything inserted after the page has
+      # loaded, so every inline form in the app opened with no cursor in it. WebKit
+      # here is the same engine Safari is, and `webkit-forms` in the Playwright
+      # config greps a single test out of the suite to run in it.
+      - name: Install browsers
+        working-directory: web
+        run: npx playwright install --with-deps chromium webkit
+
+      # The suite builds the frontend, embeds it and starts the real binary — see
+      # playwright.config.js. There is nothing to build here first.
+      - name: Test
+        working-directory: web
+        run: npm run test:e2e
+
+      # Ingen rapport at hente ned bagefter. GitHub-udgaven lægger
+      # web/playwright-report/ op som et artefakt, og det trin ER en handling fra
+      # markedspladsen — der er ikke en `run:`-form af det. Går suiten i stykker
+      # her, står grunden i loggen frem for i en zip. Skal rapporten tilbage, er
+      # det upload-artifact spejlet ind lokalt, ikke en linje mere i denne fil.
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    # Ingen `container:` her: jobbet skal bruge docker-klienten og buildx, og dem
+    # har runnerens eget ubuntu-image. En golang- eller node-container ville have
+    # sproget og mangle værktøjet.
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Build only — publishing happens on a tag, in release.yml. This job exists
+      # so a Dockerfile that no longer builds fails on the pull request rather
+      # than at release time.
+      #
+      # `type=cacheonly` frem for `--load`: resultatet skal ingen steder hen, og
+      # at hente et image ind i daemonen for straks at glemme det er et halvt
+      # minut hver kørsel. Én arkitektur er nok til at fange en Dockerfile, der
+      # ikke bygger; de to rigtige bygges på et mærkat.
+      - name: Build
+        run: |
+          set -eu
+          docker buildx create --use --name ci-verdande 2>/dev/null || docker buildx use ci-verdande
+          docker buildx build --platform linux/amd64 --output type=cacheonly .

.gitea/workflows/release.yml

@@ -0,0 +1,126 @@
+name: Release
+
+# Samme udløser som GitHub-workflowet: et semver-tag, og ikke andet.
+#
+# Gitea Actions læser samme format som GitHub Actions, men det er *ikke* det
+# samme sted. Filen ligger derfor for sig frem for at være delt: der er intet
+# `secrets.GITHUB_TOKEN`, registret er et andet, og der er ingen Releases-side at
+# skrive til. En delt fil ville være fire betingede led, der hver kun gælder ét
+# af de to steder.
+#
+# Og som i ci.yml: ingen `uses:`. Handlinger hentes fra github.com, så længe
+# DEFAULT_ACTIONS_URL ikke er sat — se den lange forklaring der.
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
+
+jobs:
+  image:
+    name: Build and publish image
+    # `ubuntu-latest` er runnerens egen etiket (`ovh-1`, docker-mode). Ingen
+    # `container:`: jobbet skal bruge docker-klienten og buildx, og dem har
+    # runnerens image.
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: gitea.nolimit.dk
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # setup-qemu-action i rå form. Uden den bygger buildx kun værtens egen
+      # arkitektur, og arm64 er ikke valgfrit: et hjemmelab er lige så tit en
+      # Raspberry Pi eller en Apple silicon-VM som en x86-kasse.
+      - name: Emulation for the other architecture
+        run: docker run --privileged --rm tonistiigi/binfmt --install arm64,amd64
+
+      - name: Builder
+        run: docker buildx create --use --name release-verdande 2>/dev/null || docker buildx use release-verdande
+
+      # `GITEA_TOKEN` er automatisk til stede i et Actions-job og har lov at
+      # skrive pakker for den, der ejer repoet. Ingen hemmelighed at sætte op.
+      # --password-stdin frem for --password: det sidste ville stå i processens
+      # kommandolinje, som enhver på maskinen kan læse.
+      - name: Log in to the registry
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: printf '%s' "$TOKEN" | docker login "$REGISTRY" -u "$GITHUB_ACTOR" --password-stdin
+
+      # metadata-action i rå form.
+      #
+      # v1.4.2 udgiver 1.4.2, 1.4, 1 og latest — så en rune, der er bundet til
+      # :1, får rettelser uden nogensinde at krydse et hovedversionsskifte.
+      #
+      # En forudgivelse (v1.4.2-rc1) får KUN sit eget nøjagtige mærkat. At lade
+      # en rc overskrive :latest eller :1 ville sende den ud til alle, der troede
+      # de fulgte det stabile spor — og mærkatmønsteret ovenfor lukker dem ind.
+      - name: Work out the tags
+        id: tags
+        run: |
+          set -eu
+          version=${GITHUB_REF_NAME#v}
+          image="$REGISTRY/$GITHUB_REPOSITORY"
+          args="--tag $image:$version"
+          case "$version" in
+            *-*) echo "Forudgivelse: kun $version." ;;
+            *)
+              minor=${version%.*}
+              major=${version%%.*}
+              args="$args --tag $image:$minor --tag $image:$major --tag $image:latest"
+              ;;
+          esac
+          echo "args=$args" >> "$GITHUB_OUTPUT"
+          echo "Mærkater: $args"
+
+      - name: Build and push
+        run: |
+          set -eu
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            ${{ steps.tags.outputs.args }} \
+            --build-arg "VERSION=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --label "org.opencontainers.image.version=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            .
+          # Ingen `cache-from: type=gha`. act_runner har en cache-tjeneste, der
+          # svarer på det navn, men den er ikke prøvet her, og en kold bygning,
+          # der tager nogle minutter længere, er billigere end en udgivelse, der
+          # fejler på noget, som ikke har med bygningen at gøre.
+
+    # Ingen Release oprettes.
+    #
+    # GitHub-workflowet laver en Release, fordi opdateringsnotitsen i appen læser
+    # `releases/latest` derfra. Gitea har sit eget Releases-begreb, men notitsen
+    # peger på GitHub — så en release her ville ingen læse. Skal notitsen flyttes
+    # med, er det `internal/update`, der skal have en ny adresse, og det er en
+    # ændring for sig. (Bemærk også, at GitHub-udgavens softprops-handling taler
+    # mod api.github.com og ikke kan genbruges her.)

.gitignore

@@ -67,5 +67,9 @@ node_modules.nosync/
 HANDOFF.md
 NOTES-PLAN.md
 
+# Samme grund: instruktionen til flytningen navngiver kassen, runneren, registret
+# og hvordan man kommer til dem. Arbejdspapir, ikke produktdokumentation.
+GITEA-FLYTNING.md
+
 # Agenternes arbejdstræer. Et git-repo inde i et git-repo, som ikke hører til her.
 .claude/worktrees/

docs/rune.md

@@ -7,14 +7,14 @@ verdande ships with a Rune manifest for
 
 ```
 create container: Error response from daemon:
-No such image: ghcr.io/kristianwind/verdande:latest
+No such image: gitea.nolimit.dk/kw/verdande:latest
 ```
 
 This message is a liar. It does not mean the tag is missing from the registry —
 it means the image is not on the host, and the panel's attempt to fetch it failed
 without saying so.
 
-The usual cause is a **private** GHCR package. Yggdrasil pulls anonymously: its
+The usual cause is a **private** package. Yggdrasil pulls anonymously: its
 `PullImage` calls the Docker SDK with no `RegistryAuth`, so a private image comes
 back 401. The pull error is discarded, and `ContainerCreate` — which only ever
 looks locally — then reports the image as missing.
@@ -24,10 +24,28 @@ looks locally — then reports the image as missing.
     sends them itself with each request. Yggdrasil is a different client and
     sends none, so logging in changes nothing for the panel.
 
-**Make the package public.** Under
+**The package has to be readable without credentials**, and the only way to know
-[Packages → verdande → Package settings](https://github.com/users/kristianwind/packages/container/package/verdande)
+is to ask the registry for a token as a stranger:
-→ *Change visibility*. The repository stays private; only the built image becomes
+
-readable, which is what the manifest and these pages have always assumed.
+```bash
+curl -s "https://ghcr.io/token?scope=repository:kristianwind/verdande:pull&service=ghcr.io"
+```
+
+A 200 with a `token` in it means anyone can pull, which means the panel can. A
+401 means it cannot, whatever the package page says.
+
+!!! danger "Do not test this with `docker --config /tmp/empty pull`"
+    It looks like the honest test and is not. An empty config directory does not
+    stop the machine's credential helper, so the pull is quietly authenticated
+    with credentials you forgot you had — and reports success for an image no
+    stranger can fetch. This cost a production instance an hour of downtime: the
+    image was declared public on that evidence, the rune was pointed at it, and
+    the host — which had never logged in — could not pull a thing.
+
+    A self-hosted Gitea is where this bites. An instance with `REQUIRE_SIGNIN_VIEW`
+    turned on refuses anonymous tokens for its registry too, and no per-package
+    setting overrides it. Making the source repository public does not change it
+    either; that was tried.
 
 Once it is public, press **Start** on the server you already have. There is no
 need to delete it and make another: the image reference is read from the rune at
@@ -37,8 +55,8 @@ To keep the package private you have to put the image on the host yourself,
 before creating the server, and again after every release:
 
 ```bash
-sudo docker login ghcr.io -u kristianwind
+sudo docker login gitea.nolimit.dk -u kw
-sudo docker pull ghcr.io/kristianwind/verdande:latest
+sudo docker pull gitea.nolimit.dk/kw/verdande:latest
 ```
 
 Run it as the user the Docker daemon runs as — `sudo` if the panel does. The

docs/self-hosting.md

@@ -6,9 +6,10 @@ cache, no queue and no second process.
 ## Docker
 
 !!! note "If the pull is refused"
-    The GHCR package is public, so this needs no credentials. If it is ever set
+    The image is published from a self-hosted Gitea and is readable without
-    back to private, `docker login ghcr.io` with a token carrying the
+    credentials — the package is not linked to a repository, so its visibility
-    `read:packages` scope before pulling — and see
+    follows the account rather than the (private) source repo. If it is ever set
+    back to private, `docker login gitea.nolimit.dk` before pulling — and see
     [the Rune page](rune.md#if-the-image-will-not-pull), because a private image
     fails differently and much more confusingly under Yggdrasil.
 

internal/ai/ai.go

@@ -47,6 +47,12 @@ type Config struct {
 	// ProviderCompatible and useful for a proxy in front of the others.
 	BaseURL string
 	Model   string
+	// AllowPrivate lets BaseURL be on this machine or its private network.
+	//
+	// Set by the caller from who is asking, never read from storage: it is the
+	// answer to "may this person reach the LAN", and that answer can change after
+	// the address was saved. See the handler for who gets it and why.
+	AllowPrivate bool
 }
 
 func (c Config) Configured() bool {
@@ -73,13 +79,17 @@ type Client struct {
 }
 
 func New(cfg Config) *Client {
+	dial := safedial.Client
+	if cfg.AllowPrivate {
+		dial = safedial.AllowPrivate
+	}
 	return &Client{
 		cfg: cfg,
 		// Generous: a local model on modest hardware can take a while to produce
 		// its first token, and the alternative is a timeout that only ever fires
 		// for the people running their own.
-		// safedial, not a plain client. `base_url` is typed into a field in the
+		// safedial by default. `base_url` is typed into a field in the interface,
-		// interface, so it is a user-supplied address — and a server that fetches a
+		// so it is a user-supplied address — and a server that fetches a
 		// user-supplied address is a way to ask it to reach things the caller
 		// cannot: the panel next door, a database on the same bridge, the cloud
 		// metadata endpoint. On a homelab that is most of what is worth reaching.
@@ -87,7 +97,13 @@ func New(cfg Config) *Client {
 		// The check is on the resolved address rather than on the URL, because a
 		// name answers whatever its owner says — and can answer differently the
 		// second time, after a parse-time check has passed.
-		http: safedial.Client(120 * time.Second),
+		//
+		// And then the exception, which is the whole reason this provider exists:
+		// a model you run yourself IS on that network. Blocking it made the two
+		// lines above true and the feature useless — the comment about a local
+		// model being slow to its first token was written for a case the dialler
+		// refused to reach. AllowPrivate is granted per request, not per address.
+		http: dial(120 * time.Second),
 	}
 }
 

internal/httpapi/integrations_handlers.go

@@ -215,20 +215,31 @@ func (s *Server) handleSetAISettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// The address is checked where it is typed, as well as when it is dialled.
+	// The address is checked where it is typed, as well as when it is dialled. A
+	// scheme other than http or https is refused outright, for everybody —
+	// file:// and gopher:// are not providers.
 	//
-	// safedial refuses a private destination at connect time and is the actual
+	// The private-network wall has one exception, and it is the point of the
-	// wall; this is so the person entering it hears about it now rather than
+	// provider it guards. "OpenAI-compatible (Ollama, LM Studio, …)" means a model
-	// discovering it later as a failed summary. A scheme other than http or https
+	// on this machine or on the desk beside it: 127.0.0.1:11434, 192.168.1.150.
-	// is refused outright — file:// and gopher:// are not providers.
+	// safedial refuses exactly those, so the address the field suggested in its
+	// own placeholder was an address the server would not accept.
+	//
+	// Admins only, because the wall is there for a real reason: a server that
+	// fetches a user-supplied address lets the person supplying it reach what
+	// they cannot reach themselves. An admin on a self-hosted instance already
+	// owns the host and everything on its network, so this grants them nothing
+	// new. An invited user is a different person, and for them it stays shut.
 	if url := strings.TrimSpace(req.BaseURL); url != "" {
 		if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
 			writeFieldErrors(w, map[string]string{"base_url": "must start with http:// or https://"})
 			return
 		}
-		if reason := safedial.CheckURL(url); reason != "" {
+		if !user.IsAdmin {
-			writeFieldErrors(w, map[string]string{"base_url": reason})
+			if reason := safedial.CheckURL(url); reason != "" {
-			return
+				writeFieldErrors(w, map[string]string{"base_url": reason})
+				return
+			}
 		}
 		req.BaseURL = url
 	}
@@ -265,11 +276,20 @@ func (s *Server) aiConfig(r *http.Request, userID string) (ai.Config, error) {
 		v, _ := values[key].(string)
 		return v
 	}
+	// Worked out per request rather than stored beside the address: it answers
+	// "may this person reach the private network", and somebody who is no longer
+	// an admin should stop being able to. A flag written at save time would
+	// outlive the role that granted it.
+	allowPrivate := false
+	if u := userFrom(r.Context()); u != nil && u.IsAdmin {
+		allowPrivate = true
+	}
 	return ai.Config{
-		Provider: ai.Provider(str("provider")),
+		Provider:     ai.Provider(str("provider")),
-		APIKey:   str("api_key"),
+		APIKey:       str("api_key"),
-		BaseURL:  str("base_url"),
+		BaseURL:      str("base_url"),
-		Model:    str("model"),
+		Model:        str("model"),
+		AllowPrivate: allowPrivate,
 	}, nil
 }
 

internal/httpapi/integrations_test.go

@@ -719,6 +719,86 @@ func TestTheAIProviderSurvivesConnectingSomethingElse(t *testing.T) {
 	}
 }
 
+// Reported from use as "the AI settings are not saved" — the second time, and a
+// different cause than the one above.
+//
+// The provider is called "OpenAI-kompatibel (Ollama, LM Studio, …)" and the
+// address field suggests http://localhost:11434/v1. Both of those live on the
+// private network, which safedial refuses — so the address the interface proposed
+// was the address the server rejected, and the one provider that exists for
+// running your own model could not be configured at all.
+//
+// It looked like a save that did nothing, because the 422 came back on a field
+// with nowhere to show it. Two bugs wearing one coat.
+func TestAdminMayPointAIAtAModelOnTheLAN(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// The three shapes a self-hosted model actually takes: another machine on the
+	// LAN, the loopback name, and the loopback address.
+	for _, addr := range []string{
+		"http://192.168.1.150:8080/v1",
+		"http://localhost:11434/v1",
+		"http://127.0.0.1:1234/v1",
+	} {
+		resp, body := ts.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+			"provider": "compatible", "model": "gemma-4-26b-qat", "base_url": addr,
+		})
+		if resp.StatusCode != http.StatusNoContent {
+			t.Fatalf("save %s: status %d, body %v", addr, resp.StatusCode, body)
+		}
+	}
+
+	_, body := ts.do(t, "GET", "/api/v1/ai/settings", nil)
+	if body["base_url"] != "http://127.0.0.1:1234/v1" {
+		t.Errorf("base_url = %v after saving, want it to have survived", body["base_url"])
+	}
+	if body["provider"] != "compatible" {
+		t.Errorf("provider = %v", body["provider"])
+	}
+}
+
+// The wall stays up for everybody else.
+//
+// An admin on a self-hosted instance already owns the host and its network, so a
+// private destination grants them nothing they did not have. An invited user is a
+// different person, and for them the address field would be a way to find out
+// what answers on the host's network.
+func TestAnInvitedUserCannotPointAIAtThePrivateNetwork(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "andreas@example.dk", "Andreas")
+
+	resp, body := other.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+		"provider": "compatible", "model": "llama3.1",
+		"base_url": "http://192.168.1.150:8080/v1",
+	})
+	if resp.StatusCode == http.StatusNoContent {
+		t.Fatal("an invited user was allowed to point the AI at the private network")
+	}
+	fields, _ := body["fields"].(map[string]any)
+	if fields["base_url"] == nil {
+		t.Errorf("the refusal did not name the field it was about: %v", body)
+	}
+}
+
+// A scheme that is not http or https is refused for everybody, admin or not.
+func TestAISettingsRefuseANonHTTPAddress(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+		"provider": "compatible", "model": "llama3.1", "base_url": "file:///etc/passwd",
+	})
+	if resp.StatusCode == http.StatusNoContent {
+		t.Fatal("file:// was accepted as a provider address")
+	}
+	fields, _ := body["fields"].(map[string]any)
+	if fields["base_url"] == nil {
+		t.Errorf("no error on base_url: %v", body)
+	}
+}
+
 func TestGmailSettings(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)

internal/safedial/safedial.go

@@ -24,17 +24,58 @@
 // lives), the private ranges, unique-local IPv6, and the unspecified address.
 // Everything else is allowed: this is not an allowlist of the internet, it is a
 // wall around the inside.
+//
+// With one named exception, for Tailscale — see tailnets below.
 package safedial
 
 import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"net/url"
 	"syscall"
 	"time"
 )
 
+// tailnets are Tailscale's own ranges, and they are not "the inside".
+//
+// A tailnet is not a network you happen to be on; it is one every member had to
+// authenticate to join. A verdande whose host is on one reaches its peers on
+// purpose, and the operator who joined it meant to.
+//
+// Half of this already worked, by luck rather than intent: Go's IsPrivate covers
+// RFC1918 and not the carrier-grade NAT range Tailscale borrows, so 100.x
+// addresses passed the wall without anybody deciding they should. The IPv6 half
+// did not — fd7a:115c:a1e0::/48 sits inside fc00::/7 and was refused. The same
+// machine was reachable or not depending on which family its address had, which
+// is the kind of difference nobody debugs on purpose.
+//
+// Naming both makes the allowance deliberate, and writes down its cost: on an
+// instance with people you have invited, this is a network they can now ask the
+// server to reach. That is the trade, and it is the operator's to make.
+var tailnets = []netip.Prefix{
+	netip.MustParsePrefix("100.64.0.0/10"),
+	netip.MustParsePrefix("fd7a:115c:a1e0::/48"),
+}
+
+// IsTailscale reports whether an address belongs to a tailnet.
+func IsTailscale(ip net.IP) bool {
+	addr, ok := netip.AddrFromSlice(ip)
+	if !ok {
+		return false
+	}
+	// Unmap first: ParseIP gives a v4 address as 4-in-6, and a v4 prefix does not
+	// contain a v6-shaped address however equal the two look when printed.
+	addr = addr.Unmap()
+	for _, n := range tailnets {
+		if n.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
 // ErrPrivate is returned when a connection was refused for where it pointed. It
 // deliberately does not say which address it resolved to: the answer is itself
 // the thing an attacker is fishing for.
@@ -46,8 +87,15 @@ func (e *ErrPrivate) Error() string {
 
 // Blocked reports whether an address must not be dialled.
 func Blocked(ip net.IP) bool {
-	return ip == nil ||
+	if ip == nil {
-		ip.IsLoopback() ||
+		return true
+	}
+	// Before the private check, not after: a tailnet's IPv6 range is unique-local,
+	// so asking IsPrivate first would refuse it.
+	if IsTailscale(ip) {
+		return false
+	}
+	return ip.IsLoopback() ||
 		ip.IsUnspecified() ||
 		ip.IsLinkLocalUnicast() ||
 		ip.IsLinkLocalMulticast() ||

internal/safedial/safedial_test.go

@@ -53,3 +53,47 @@ func TestAllowPrivateStillReaches(t *testing.T) {
 	}
 	resp.Body.Close()
 }
+
+// Tailscale skal virke, og på begge familier.
+//
+// IPv4-halvdelen slap allerede igennem, men ved et tilfælde: Gos IsPrivate
+// dækker RFC1918 og ikke det CGNAT-område, Tailscale låner. IPv6-halvdelen gjorde
+// ikke — fd7a:115c:a1e0::/48 ligger inde i fc00::/7. Samme maskine var altså
+// tilgængelig eller ej alt efter, hvilken adressefamilie man ramte den på.
+//
+// Testen står her for at holde begge dele fast: at 100.x er tilladt med vilje og
+// ikke af held, og at fd7a: ikke ryger tilbage bag muren, næste gang nogen rydder
+// op i prædikatet.
+func TestTailnetIsNotTheInside(t *testing.T) {
+	for _, s := range []string{
+		"100.64.0.0", "100.100.100.100", "100.127.255.255",
+		"fd7a:115c:a1e0::1", "fd7a:115c:a1e0:ab12:3456:7890:abcd:ef01",
+	} {
+		if Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = true, men det er en tailnet-adresse", s)
+		}
+		if !IsTailscale(net.ParseIP(s)) {
+			t.Errorf("IsTailscale(%s) = false", s)
+		}
+	}
+
+	// Undtagelsen skal være så smal, som den er navngivet. Naboerne til området
+	// er ikke Tailscale, og en anden unique-local-adresse er stadig indenfor.
+	for _, s := range []string{
+		"100.63.255.255", // lige under 100.64.0.0/10
+		"100.128.0.0",    // lige over
+		"fd00::1",        // unique-local, men ikke Tailscales
+		"fd7b:115c:a1e0::1",
+		"192.168.1.150",
+	} {
+		if IsTailscale(net.ParseIP(s)) {
+			t.Errorf("IsTailscale(%s) = true, men den ligger uden for området", s)
+		}
+	}
+	// Og de af dem, der er indenfor, skal stadig være det.
+	for _, s := range []string{"fd00::1", "fd7b:115c:a1e0::1", "192.168.1.150"} {
+		if !Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = false — muren er væk for mere end Tailscale", s)
+		}
+	}
+}

rune/verdande.yaml

@@ -15,12 +15,37 @@ gameskill:
   # this: a manifest with new fields and an unchanged version is a manifest the
   # panel has no reason to re-read, so the fields never appear and the failure is
   # silent — the server's settings page simply does not offer them.
-  version: 4
+  # Bumpet til 6: v5 flyttede imaget til vores egen Gitea, og det virkede ikke.
+  # En rune opdaterer ikke sig selv — panelet skriver rune-rækken fra en
+  # UI-handling, så ændringen her kræver **Runes → verdande → Update**, og
+  # katalog-listen caches ti minutter, så to forsøg lige efter hinanden kan begge
+  # give den gamle version.
+  version: 6
   icon: "app"
 
   # The image is distroless — no shell — so keep_entrypoint runs the binary the
   # image already declares as its ENTRYPOINT, and startup.exec passes it argv
   # directly rather than through /bin/sh, which does not exist in there.
+  # GHCR, ikke vores egen Gitea. v5 prøvede det sidste og tog instansen ned.
+  #
+  # Panelets `PullImage` sætter aldrig `RegistryAuth`, så registret SKAL kunne
+  # læses uden legitimation. GHCR kan: dens token-endepunkt svarer 200 og udsteder
+  # en pull-token til hvem som helst. Gitea på gitea.nolimit.dk kan ikke —
+  # `/v2/token?scope=repository:kw/verdande:pull` svarer 401, også efter at repoet
+  # blev gjort offentligt. Instansen kræver login på alt, registret inklusive, og
+  # det er en indstilling for hele instansen frem for for denne pakke.
+  #
+  # Sådan ser det ud, når det går galt, for det tog en time at finde: panelet
+  # river containeren ned for at anvende runen, pullet fejler, `pullImageRetry`
+  # kasserer fejlen, og `ContainerCreate` slår derefter op LOKALT og siger
+  # `No such image`. Serveren står som "running" uden container_id, og udadtil er
+  # det en 502. Fejlen nævner aldrig, at det var et login, der manglede.
+  #
+  # Sådan afgør man det, uden at blive narret: spørg registrets token-endepunkt
+  # med `curl` og se efter en 200 med et token i. Test det ALDRIG med
+  # `docker --config <tom-mappe> pull` — en tom config stopper ikke maskinens
+  # credential-helper, så pullet bliver autentificeret uden at se sådan ud, og
+  # svaret er præcis det modsatte af sandheden.
   docker:
     image: "ghcr.io/kristianwind/verdande:latest"
     data_path: /data

web/src/routes/indstillinger/ai/+page.svelte

@@ -21,6 +21,13 @@
 		{ value: 'compatible', label: 'OpenAI-kompatibel (Ollama, LM Studio, …)' }
 	];
 
+	// Every field error needs somewhere to appear, and this list is the check that
+	// it does. `base_url` had nowhere: a refused address set `errors`, skipped the
+	// toast because the object was not empty, and then rendered nothing — so the
+	// one provider meant for running your own model looked like a save that did
+	// nothing at all. Anything without a slot is shouted rather than dropped.
+	const SHOWN = ['provider', 'model', 'base_url'];
+
 	// Suggestions, not a closed list: the model field is free text, because a new
 	// model name must not require a new release of this app to be usable.
 	const SUGGESTED_MODEL = {
@@ -56,7 +63,8 @@
 			saved = true;
 		} catch (e) {
 			errors = e.fields ?? {};
-			if (!Object.keys(errors).length) app.toast(humanMessage(e));
+			const homeless = Object.keys(errors).filter((field) => !SHOWN.includes(field));
+			if (!Object.keys(errors).length || homeless.length) app.toast(humanMessage(e));
 		} finally {
 			saving = false;
 		}
@@ -105,6 +113,7 @@
 						bind:value={settings.model}
 						placeholder={SUGGESTED_MODEL[settings.provider] ?? ''}
 					/>
+					{#if errors.model}<p class="error">{errors.model}</p>{/if}
 				</div>
 
 				{#if settings.provider === 'compatible'}
@@ -116,6 +125,7 @@
 							bind:value={settings.base_url}
 							placeholder="http://localhost:11434/v1"
 						/>
+						{#if errors.base_url}<p class="error">{errors.base_url}</p>{/if}
 					</div>
 				{/if}