Nomad changes again

.gitea/workflows/deploy.yml

@@ -42,6 +42,30 @@ jobs:
       - name: Validate job
         run: nomad job validate continuwuity.hcl
 
+      - name: Mirror image to registry.i80.dk
+        env:
+          UPSTREAM: forgejo.ellis.link/continuwuation/continuwuity:latest
+          IMAGE: registry.i80.dk/continuwuity
+          REGISTRY: registry.i80.dk
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            echo "❌ docker not found on the runner — needed to mirror the image."
+            exit 1
+          fi
+          if [ -n "$REGISTRY_USER" ]; then
+            echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+          else
+            echo "ℹ️  REGISTRY_USER not set — assuming anonymous/pre-configured push to $REGISTRY"
+          fi
+          docker pull "$UPSTREAM"
+          docker tag "$UPSTREAM" "$IMAGE:latest"
+          docker tag "$UPSTREAM" "$IMAGE:${{ github.sha }}"
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:${{ github.sha }}"
+          echo "✅ mirrored $UPSTREAM -> $IMAGE:latest (+ :${{ github.sha }} for rollback)"
+
       - name: Plan (diff, non-blocking)
         run: |
           # plan exit codes: 0 = no changes, 1 = changes will be made, anything else = error

continuwuity.hcl

@@ -127,8 +127,9 @@ EOF
       }
 
       config {
-        # TODO: pin to a released tag instead of :latest before going to prod.
+        # Mirrored from upstream into registry.i80.dk by the deploy workflow.
-        image      = "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        # Must match IMAGE in .gitea/workflows/deploy.yml.
+        image      = "registry.i80.dk/continuwuity:latest"
         ports      = ["http"]
         force_pull = true # required with :latest — otherwise Nomad reuses the cached image on redeploy
       }