From 678a4afe5e571e7813eb1e2d30141bb4cf5aaa06 Mon Sep 17 00:00:00 2001
From: Henrik Jess Nielsen <henrik@i80.dk>
Date: Mon, 29 Jun 2026 16:28:14 +0200
Subject: [PATCH] Nomad changes again

---
 .gitea/workflows/deploy.yml | 24 ++++++++++++++++++++++++
 continuwuity.hcl            |  5 +++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4e867e0..4f3449d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -42,6 +42,30 @@ jobs:
       - name: Validate job
         run: nomad job validate continuwuity.hcl
 
+      - name: Mirror image to registry.i80.dk
+        env:
+          UPSTREAM: forgejo.ellis.link/continuwuation/continuwuity:latest
+          IMAGE: registry.i80.dk/continuwuity
+          REGISTRY: registry.i80.dk
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            echo "❌ docker not found on the runner — needed to mirror the image."
+            exit 1
+          fi
+          if [ -n "$REGISTRY_USER" ]; then
+            echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+          else
+            echo "ℹ️  REGISTRY_USER not set — assuming anonymous/pre-configured push to $REGISTRY"
+          fi
+          docker pull "$UPSTREAM"
+          docker tag "$UPSTREAM" "$IMAGE:latest"
+          docker tag "$UPSTREAM" "$IMAGE:${{ github.sha }}"
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:${{ github.sha }}"
+          echo "✅ mirrored $UPSTREAM -> $IMAGE:latest (+ :${{ github.sha }} for rollback)"
+
       - name: Plan (diff, non-blocking)
         run: |
           # plan exit codes: 0 = no changes, 1 = changes will be made, anything else = error
diff --git a/continuwuity.hcl b/continuwuity.hcl
index dca583f..7cfe132 100644
--- a/continuwuity.hcl
+++ b/continuwuity.hcl
@@ -127,8 +127,9 @@ EOF
       }
 
       config {
-        # TODO: pin to a released tag instead of :latest before going to prod.
-        image      = "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        # Mirrored from upstream into registry.i80.dk by the deploy workflow.
+        # Must match IMAGE in .gitea/workflows/deploy.yml.
+        image      = "registry.i80.dk/continuwuity:latest"
         ports      = ["http"]
         force_pull = true # required with :latest — otherwise Nomad reuses the cached image on redeploy
       }