From 0394f0ea2a66c36bd07d35c0e14e29b2e053d34d Mon Sep 17 00:00:00 2001
From: root <melabidi@alrahmaisgl.org>
Date: Thu, 2 Jul 2026 11:36:35 -0400
Subject: [PATCH] Update production registry pull over VPN

Configure production defaults to pull images directly from the VPN registry at 10.0.0.4, with the VPS reachable at 10.0.0.1, and disable archive handoff by default.
---
 production/.env.docker.production.example          | 10 +++++-----
 production/README.md                               |  9 +++++++--
 production/scripts/docker-prod-run-pulled-image.sh |  4 ++--
 scripts/docker-prod-common.sh                      |  2 +-
 scripts/docker-prod-run-pulled-image.sh            |  4 ++--
 5 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/production/.env.docker.production.example b/production/.env.docker.production.example
index fe0584c..1817746 100644
--- a/production/.env.docker.production.example
+++ b/production/.env.docker.production.example
@@ -16,11 +16,11 @@ REGISTRY_HOST=10.0.0.4
 REGISTRY_USER=melabidi
 REGISTRY_PASSWORD=
 
-# Optional shared folder for image archives created by the VPN/registry helper container.
-# The VPS cannot reach the VPN-only registry, so archive loading is required.
-IMAGE_ARCHIVE_DIR=/opt/docker-image-transfer
-IMAGE_ARCHIVE_REQUIRED=true
-# Optional VPN container name/id used by deploy-production.sh to fetch a missing image archive.
+# Optional shared folder for image archives. Leave empty when the VPS can pull from the VPN registry directly.
+# Current production VPN routing: VPS 10.0.0.1 can reach registry 10.0.0.4.
+IMAGE_ARCHIVE_DIR=
+IMAGE_ARCHIVE_REQUIRED=false
+# Optional VPN container name/id used only for archive handoff deployments.
 # VPN_CONTAINER=
 
 # Database
diff --git a/production/README.md b/production/README.md
index 71af968..cb8252c 100644
--- a/production/README.md
+++ b/production/README.md
@@ -42,16 +42,21 @@ If Docker needs to log in before pulling the app image, also set:
 - `REGISTRY_USER`
 - `REGISTRY_PASSWORD`
 
-For the current VPN-reachable image registry, use:
+For the current VPN-reachable image registry, use direct pulls from the VPS.
+The registry is `10.0.0.4`, and the VPS WireGuard address is `10.0.0.1`.
 
 ```env
 APP_IMAGE=10.0.0.4/melabidi/carmanagement
 REGISTRY_HOST=10.0.0.4
+REGISTRY_USER=melabidi
+IMAGE_ARCHIVE_DIR=
+IMAGE_ARCHIVE_REQUIRED=false
 ```
 
 ## VPN Container Image Handoff
 
-If the registry is only reachable inside a VPN container, use the shared archive folder:
+This fallback is only needed if the VPS cannot reach `10.0.0.4` directly. If the
+registry is only reachable inside a VPN container, use the shared archive folder:
 
 ```env
 IMAGE_ARCHIVE_DIR=/opt/docker-image-transfer
diff --git a/production/scripts/docker-prod-run-pulled-image.sh b/production/scripts/docker-prod-run-pulled-image.sh
index 2ea4430..499e106 100755
--- a/production/scripts/docker-prod-run-pulled-image.sh
+++ b/production/scripts/docker-prod-run-pulled-image.sh
@@ -5,9 +5,9 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "${ROOT_DIR}/scripts/docker-prod-common.sh"
 
-APP_IMAGE="${APP_IMAGE:-registry.rentaldrivego.ma/rentaldrivego/car_management_system}"
+APP_IMAGE="${APP_IMAGE:-10.0.0.4/melabidi/carmanagement}"
 APP_VERSION="${APP_VERSION:-${1:-}}"
-REGISTRY_USER="${REGISTRY_USER:-rentaldrivego_registry}"
+REGISTRY_USER="${REGISTRY_USER:-melabidi}"
 INCLUDE_PGMANAGE="${INCLUDE_PGMANAGE:-0}"
 POSTGRES_CONTAINER="${PROJECT_NAME}-postgres-1"
 REDIS_CONTAINER="${PROJECT_NAME}-redis-1"
diff --git a/scripts/docker-prod-common.sh b/scripts/docker-prod-common.sh
index a7193cf..fe22cda 100644
--- a/scripts/docker-prod-common.sh
+++ b/scripts/docker-prod-common.sh
@@ -283,7 +283,7 @@ pull_prod_release_images() {
 
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled, but no archive for IMAGE_TAG=${IMAGE_TAG} was found in ${IMAGE_ARCHIVE_DIR:-<unset>}." >&2
-    echo "The VPS cannot reach the VPN-only registry. Create a shared archive first, for example:" >&2
+    echo "Direct docker pull is disabled in this mode. Create a shared archive first, for example:" >&2
     echo "  docker save ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG} -o ${IMAGE_ARCHIVE_DIR:-./image-archives}/carmanagement-${IMAGE_TAG}.tar" >&2
     exit 1
   fi
diff --git a/scripts/docker-prod-run-pulled-image.sh b/scripts/docker-prod-run-pulled-image.sh
index 6a539dc..3c161d3 100644
--- a/scripts/docker-prod-run-pulled-image.sh
+++ b/scripts/docker-prod-run-pulled-image.sh
@@ -5,9 +5,9 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "${ROOT_DIR}/scripts/docker-prod-common.sh"
 
-APP_IMAGE="${APP_IMAGE:-registry.rentaldrivego.ma/rentaldrivego/car_management_system}"
+APP_IMAGE="${APP_IMAGE:-10.0.0.4/melabidi/carmanagement}"
 APP_VERSION="${APP_VERSION:-${1:-}}"
-REGISTRY_USER="${REGISTRY_USER:-rentaldrivego_registry}"
+REGISTRY_USER="${REGISTRY_USER:-melabidi}"
 INCLUDE_PGMANAGE="${INCLUDE_PGMANAGE:-0}"
 POSTGRES_CONTAINER="${PROJECT_NAME}-postgres-1"
 REDIS_CONTAINER="${PROJECT_NAME}-redis-1"