Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 10 Projects Releases Packages Wiki Activity Actions 3

registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com #161

Merged
emi merged 1 commit from feat/registry-jinemi-migration into dev 2026-08-01 23:13:12 +00:00
Conversation 0 Commits 1 Files changed 36 +215 -138
emi commented 2026-08-01 23:06:56 +00:00
Owner
Copy link

Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com
earlier; deploy/forgejo/README.md recorded the registry half as
"deliberately not done". This does it, and renames Centralis' endpoint to
mcp.jinemi.com in the two places this repo names it.

What changed

  • Registry host — every image name, REGISTRY_HOST default, runner label
    and --add-host pin now says dev.jinemi.com: both compose files, both
    Swarm stacks, deploy.sh, deploy-stack.sh, the Terraform host module,
    register-lan-runner.sh, the ci-runner Dockerfile and runner-vps2/.
  • MCP — mcp.thermograph.org -> mcp.jinemi.com in Caddyfile.vps2's
    header and the claude mcp add line in onboarding. Centralis itself is
    provisioned outside this repo.
  • Docs — the migration narrative in deploy/forgejo/README.md,
    caddy-git.conf, docker-stack.yml, infra/CLAUDE.md, ACCESS.md,
    DEPLOY.md, DEPLOY-DEV.md and the onboarding set inverts: the registry is
    no longer the reason the old name is kept.

Why the old name stays served

Both names address the same Forgejo, so the same packages. A tag pushed as
git.thermograph.org/jinemi/thermograph/backend:sha-abc is pullable as
dev.jinemi.com/...:sha-abc — the host part is how you reach the registry,
not part of the package's identity. No image needs re-pushing and a rollback
to an old tag still resolves. git.thermograph.org stays on the same
Caddy site block (one block, so the /v2/* mesh-only matcher keeps covering
both — splitting it would undo hazard #15) for pre-migration tags and for
runners holding it as their registered instance URL.

Mesh clients now pin both names in /etc/hosts: the new one is the
registry host and the bearer-token realm (Forgejo derives the realm from
ROOT_URL), the old one is dialled directly by a rollback to a pre-migration
tag. runner-vps2/config.yaml carries both --add-host entries for the same
reason.

Host-side steps this PR cannot do

Documented under "Host-side steps" in deploy/forgejo/README.md:

  1. /etc/hosts pins for dev.jinemi.com on every mesh client
  2. docker login dev.jinemi.com on each pushing/pulling host — a login
    against the old name does not carry over
  3. the Forgejo Actions variable REGISTRY_HOST -> dev.jinemi.com;
    build-push.yml reads the variable, so a repo-side rename alone leaves CI
    on the old host
  4. re-registering runners against https://dev.jinemi.com (optional)

Missing 1 or 2 fails as unauthorized: reqPackageAccess, which names neither.

mcp.jinemi.com needs its own DNS record, vps2 Caddy site block and Centralis
config, all outside this repo.

Checks

  • shellcheck -x over all 42 scripts: zero findings
  • docker compose config renders dev.jinemi.com/... for all five
    compose/stack files
  • caddy adapt on caddy-git.conf: both hosts in one site block, /v2/*
    matcher and 10.10.0.0/24 restriction intact
Completes the Forgejo domain migration. `ROOT_URL` moved to `dev.jinemi.com` earlier; `deploy/forgejo/README.md` recorded the registry half as "deliberately not done". This does it, and renames Centralis' endpoint to `mcp.jinemi.com` in the two places this repo names it. ## What changed - **Registry host** — every image name, `REGISTRY_HOST` default, runner label and `--add-host` pin now says `dev.jinemi.com`: both compose files, both Swarm stacks, `deploy.sh`, `deploy-stack.sh`, the Terraform host module, `register-lan-runner.sh`, the ci-runner Dockerfile and `runner-vps2/`. - **MCP** — `mcp.thermograph.org` -> `mcp.jinemi.com` in `Caddyfile.vps2`'s header and the `claude mcp add` line in onboarding. Centralis itself is provisioned outside this repo. - **Docs** — the migration narrative in `deploy/forgejo/README.md`, `caddy-git.conf`, `docker-stack.yml`, `infra/CLAUDE.md`, `ACCESS.md`, `DEPLOY.md`, `DEPLOY-DEV.md` and the onboarding set inverts: the registry is no longer the reason the old name is kept. ## Why the old name stays served Both names address the same Forgejo, so the same packages. A tag pushed as `git.thermograph.org/jinemi/thermograph/backend:sha-abc` is pullable as `dev.jinemi.com/...:sha-abc` — the host part is how you reach the registry, not part of the package's identity. No image needs re-pushing and a rollback to an old tag still resolves. `git.thermograph.org` stays on the **same** Caddy site block (one block, so the `/v2/*` mesh-only matcher keeps covering both — splitting it would undo hazard #15) for pre-migration tags and for runners holding it as their registered instance URL. Mesh clients now pin **both** names in `/etc/hosts`: the new one is the registry host *and* the bearer-token realm (Forgejo derives the realm from `ROOT_URL`), the old one is dialled directly by a rollback to a pre-migration tag. `runner-vps2/config.yaml` carries both `--add-host` entries for the same reason. ## Host-side steps this PR cannot do Documented under "Host-side steps" in `deploy/forgejo/README.md`: 1. `/etc/hosts` pins for `dev.jinemi.com` on every mesh client 2. `docker login dev.jinemi.com` on each pushing/pulling host — a login against the old name does not carry over 3. the Forgejo Actions variable **`REGISTRY_HOST`** -> `dev.jinemi.com`; `build-push.yml` reads the variable, so a repo-side rename alone leaves CI on the old host 4. re-registering runners against `https://dev.jinemi.com` (optional) Missing 1 or 2 fails as `unauthorized: reqPackageAccess`, which names neither. `mcp.jinemi.com` needs its own DNS record, vps2 Caddy site block and Centralis config, all outside this repo. ## Checks - `shellcheck -x` over all 42 scripts: zero findings - `docker compose config` renders `dev.jinemi.com/...` for all five compose/stack files - `caddy adapt` on `caddy-git.conf`: both hosts in one site block, `/v2/*` matcher and `10.10.0.0/24` restriction intact
emi added 1 commit 2026-08-01 23:06:57 +00:00
registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com
All checks were successful
Sync infra to hosts / sync-beta (push) Has been skipped
Details
Sync infra to hosts / sync-prod (push) Has been skipped
Details
Sync infra to hosts / sync-centralis (push) Has been skipped
Details
Sync infra to hosts / sync-dev (push) Successful in 9s
Details
secrets-guard / encrypted (push) Successful in 5s
Details
Validate observability stack / validate (push) Successful in 12s
Details
shell-lint / shellcheck (push) Successful in 8s
Details
Build + push images (Forgejo registry) / build-push (frontend) (push) Successful in 26s
Details
Build + push images (Forgejo registry) / build-push (backend) (push) Successful in 1m10s
Details
Deploy / deploy (backend) (push) Successful in 1m41s
Details
Deploy / deploy (frontend) (push) Successful in 1m48s
Details
secrets-guard / encrypted (pull_request) Successful in 8s
Details
shell-lint / shellcheck (pull_request) Successful in 9s
Details
PR build (required check) / changes (pull_request) Successful in 20s
Details
PR build (required check) / validate-observability (pull_request) Successful in 15s
Details
PR build (required check) / build-frontend (pull_request) Successful in 17s
Details
PR build (required check) / build-backend (pull_request) Successful in 2m26s
Details
PR build (required check) / gate (pull_request) Successful in 1s
Details
53e2eb7c84 
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com
earlier; the registry half was deliberately deferred. Every image name,
REGISTRY_HOST default, runner label and --add-host pin now names
dev.jinemi.com, so the registry host and the bearer-token realm agree again.

Both names address the same Forgejo, so no image needs re-pushing and a
rollback to a tag pushed under the old prefix still resolves.
git.thermograph.org therefore stays served off the same Caddy site block --
one block, so the /v2/* mesh-only matcher keeps covering both names -- for
pre-migration tags and for runners holding it as their registered instance
URL.

Mesh clients now pin both names in /etc/hosts: the new one as registry host
and token realm, the old one for pre-migration tags. runner-vps2/config.yaml
carries both --add-host entries for the same reason.

Also renames Centralis' endpoint to mcp.jinemi.com in the two places this
repo names it; Centralis itself is provisioned outside this repo.

Host-side steps this cannot do (documented in deploy/forgejo/README.md,
"Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login
against the new host, and the /etc/hosts pins.
emi changed title from WIP: registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com to registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com 2026-08-01 23:13:02 +00:00
emi merged commit 53e2eb7c84 into dev 2026-08-01 23:13:12 +00:00
emi deleted branch feat/registry-jinemi-migration 2026-08-01 23:13:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Jinemi/thermograph#161
No description provided.
Delete branch "feat/registry-jinemi-migration"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?