Add CRI-O registry config for private images and Tailscale mirror

- Add direct access config for host.containers.internal:5050 (insecure)
- Add mirror config for registry.tail8d86e.ts.net -> host.containers.internal:5050
- Revert statefulset to use registry.tail8d86e.ts.net (cleaner, if mirror works)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

ansible/roles/minikube/files/zot-mirror.conf

@@ -2,6 +2,22 @@
 # Uses host.containers.internal which is stable across restarts
 # Applied by ansible minikube role
 
+# Direct access to Zot for private images (blumeops/*)
+[[registry]]
+prefix = "host.containers.internal:5050"
+location = "host.containers.internal:5050"
+insecure = true
+
+# Tailscale hostname for Zot - redirects to local access
+# Allows manifests to use registry.tail8d86e.ts.net which is cleaner
+[[registry]]
+prefix = "registry.tail8d86e.ts.net"
+location = "registry.tail8d86e.ts.net"
+
+[[registry.mirror]]
+location = "host.containers.internal:5050"
+insecure = true
+
 [[registry]]
 prefix = "docker.io"
 location = "docker.io"

argocd/manifests/devpi/statefulset.yaml

@@ -18,8 +18,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: devpi
-          # Use host.containers.internal for minikube's CRI-O to reach Zot on indri
-          image: host.containers.internal:5050/blumeops/devpi:latest
+          image: registry.tail8d86e.ts.net/blumeops/devpi:latest
           args:
             - "--serverdir"
             - "/devpi"