From e0d6b79e6859f149a411a090c4b93ebf3ce31863 Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Sat, 25 Jul 2026 22:02:53 +0200
Subject: [PATCH] use the working duckdns hostname for the registry, fix trivy
 github auth

gitea.zb.local resolves but is plain HTTP, which Docker refuses as a
registry without daemon-level insecure-registry config. gitea.zb.lan
resolves but nothing answers there yet (proxy not configured for it).
gitea.zb-kw.duckdns.org is confirmed reachable end-to-end over HTTPS,
including the registry v2 API, from both the runner and the deploy
target, so use that consistently. Also fix aquasecurity/trivy-action's
token-setup-trivy input, which defaults to gitea.token and gets
rejected by github.com when it tries to clone the install script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .gitea/workflows/pipeline.yml | 16 ++++++++++------
 docker-compose.yml            |  2 +-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/pipeline.yml b/.gitea/workflows/pipeline.yml
index 10d014a..fb51017 100644
--- a/.gitea/workflows/pipeline.yml
+++ b/.gitea/workflows/pipeline.yml
@@ -47,23 +47,27 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Build Docker image
-        run: docker build -t gitea.zb.local/willem/glucose-dashboard:${{ gitea.sha }} .
+        run: docker build -t gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} .
 
       - name: Trivy scan
         uses: aquasecurity/trivy-action@master
         with:
-          image-ref: gitea.zb.local/willem/glucose-dashboard:${{ gitea.sha }}
+          image-ref: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
           severity: CRITICAL,HIGH
           exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden
+          # gitea.token is geen geldig GitHub-token; leeg laten zodat setup-trivy
+          # de aquasecurity/trivy-repo anoniem kan clonen in plaats van een
+          # ongeldige Authorization-header naar github.com te sturen.
+          token-setup-trivy: ""
 
       - name: Login bij Gitea-registry
-        run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb.local -u willem --password-stdin
+        run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb-kw.duckdns.org -u willemjan --password-stdin
 
       - name: Tag en push
         run: |
-          docker tag gitea.zb.local/willem/glucose-dashboard:${{ gitea.sha }} gitea.zb.local/willem/glucose-dashboard:latest
-          docker push gitea.zb.local/willem/glucose-dashboard:${{ gitea.sha }}
-          docker push gitea.zb.local/willem/glucose-dashboard:latest
+          docker tag gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
+          docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
+          docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
 
   # ---------------------------------------------------------------------
   # 4. Deploy — SSH naar de LXC en herstart met de nieuwe image
diff --git a/docker-compose.yml b/docker-compose.yml
index d840770..073ffd1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   glucose-dashboard:
-    image: gitea.zb.local/willem/glucose-dashboard:latest
+    image: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
     container_name: glucose-dashboard
     restart: unless-stopped
     ports: