gitea.zb.local resolves but is plain HTTP, which Docker refuses as a
registry without daemon-level insecure-registry config. gitea.zb.lan
resolves but nothing answers there yet (proxy not configured for it).
gitea.zb-kw.duckdns.org is confirmed reachable end-to-end over HTTPS,
including the registry v2 API, from both the runner and the deploy
target, so use that consistently. Also fix aquasecurity/trivy-action's
token-setup-trivy input, which defaults to gitea.token and gets
rejected by github.com when it tries to clone the install script.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
gitea.thuis.local doesn't resolve on this network; the real internal
Gitea hostname is gitea.zb.local. Also load .env via python-dotenv so
the app works the same under PowerShell as bash, and add .dockerignore
so .env never ends up baked into the image.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
willemjanandClaude Sonnet 5