Erich Blume
c86b5d7772
## Summary
- Move Dagger module from `.dagger/` to repo root (`src/blumeops/`), rename `blumeops-ci` → `blumeops`
- Replace opaque `docker_build()` with native Dagger pipelines that surface full build errors per step
- Migrate navidrome as the first container (`containers/navidrome/container.py`)
- Upgrade navidrome from v0.60.3 to v0.61.1 (major artwork overhaul, SQLite FTS5 search, server-managed transcoding)
- Add `dagger call container-version` for CI version extraction without Dockerfile parsing
- All mise tasks (`container-list`, `container-version-check`, `container-build-and-release`) updated for hybrid mode
- Legacy `docker_build()` fallback preserved for all other containers
## Motivation
When navidrome v0.61.0 added a new Go build tag (`sqlite_fts5`), `docker_build()` showed only "exit code: 1". We had to run `docker build --progress=plain` manually to find `undefined: buildtags.SQLITE_FTS5`. Native Dagger pipelines show the full error inline.
## Container build dispatch needed
After merge, dispatch container build for navidrome:
```
mise run container-build-and-release navidrome --ref 470b4bd
```
## Deploy steps
1. Wait for container build to complete
2. Back up navidrome-data PVC (non-reversible DB migrations)
3. `argocd app set navidrome --revision main && argocd app sync navidrome`
4. Verify at https://dj.ops.eblu.me
## Future
Remaining containers migrate incrementally in follow-up PRs using the same pattern.
Reviewed-on: #330
48 lines
2 KiB
Markdown
48 lines
2 KiB
Markdown
---
|
|
title: Wire CI Registry Auth
|
|
modified: 2026-04-11
|
|
tags:
|
|
- how-to
|
|
- zot
|
|
- ci
|
|
- forgejo
|
|
---
|
|
|
|
# Wire CI Registry Auth
|
|
|
|
How CI pipelines authenticate to the zot registry after OIDC + apikey auth is enabled.
|
|
|
|
## Overview
|
|
|
|
The `zot-ci` service account (created in [[register-zot-oidc-client]]) belongs to the `artifact-workloads` group, granting `["read", "create"]` permissions — CI can push new tags but cannot overwrite or delete existing ones.
|
|
|
|
Authentication uses a zot API key generated after the service account's first OIDC login. The key is stored in 1Password (`Forgejo Secrets` item, field `zot-ci-api`, in blumeops vault) and synced to Forgejo Actions secrets via the `forgejo_actions_secrets` ansible role. The key expires every 90 days — see [[zot#API Key Rotation]] for the rotation procedure.
|
|
|
|
## Push Paths
|
|
|
|
### Dagger path (Dockerfile containers)
|
|
|
|
`.forgejo/workflows/build-container.yaml` passes `--registry-password=env:ZOT_CI_API_KEY` to the Dagger `publish()` function, which calls `with_registry_auth()` before pushing.
|
|
|
|
### Nix/skopeo path (Nix containers)
|
|
|
|
`.forgejo/workflows/build-container-nix.yaml` passes `--dest-creds=zot-ci:$ZOT_CI_API_KEY` to `skopeo copy`.
|
|
|
|
## Secret Flow
|
|
|
|
1Password `Forgejo Secrets` item (field `zot-ci-api`) → ansible pre_task fetches it → `forgejo_actions_secrets` role syncs to Forgejo API → both runners (k8s on indri, host on ringtail) access it as `${{ secrets.ZOT_CI_API_KEY }}`.
|
|
|
|
## Key Files
|
|
|
|
| File | Purpose |
|
|
|------|---------|
|
|
| `src/blumeops/main.py` | `publish()` accepts optional `registry_password` |
|
|
| `.forgejo/workflows/build-container.yaml` | Passes API key to Dagger |
|
|
| `.forgejo/workflows/build-container-nix.yaml` | Passes API key to skopeo |
|
|
| `ansible/playbooks/indri.yml` | Pre_task fetches API key from 1Password |
|
|
| `ansible/roles/forgejo_actions_secrets/defaults/main.yml` | Secret entry for `ZOT_CI_API_KEY` |
|
|
|
|
## Related
|
|
|
|
- [[harden-zot-registry]] — Parent goal
|
|
- [[register-zot-oidc-client]] — OIDC client registration
|