Support registry token for VPN image pulls

scripts/docker-prod-common.sh

@@ -111,10 +111,16 @@ load_prod_env_exports() {
     IMAGE_ARCHIVE_REQUIRED \
     REGISTRY_HOST \
     REGISTRY_USER \
-    REGISTRY_PASSWORD
+    REGISTRY_PASSWORD \
+    REGISTRY_TOKEN
   do
     export_env_value_if_unset "${key}"
   done
+
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
 }
 
 validate_prod_env_file() {
@@ -239,6 +245,11 @@ require_release_image() {
 }
 
 login_registry_if_configured() {
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
+
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled; skipping docker login."
     return 0
@@ -267,7 +278,7 @@ login_registry_if_configured() {
   fi
 
   if [[ -z "${REGISTRY_HOST:-}" || -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
-    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD are all required when registry credentials are configured." >&2
+    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD or REGISTRY_TOKEN are required when registry credentials are configured." >&2
     exit 1
   fi
 

scripts/docker-prod-run-pulled-image.sh

@@ -55,19 +55,19 @@ prompt_registry_password_if_needed() {
     return 0
   fi
 
-  if [[ -n "${REGISTRY_PASSWORD:-}" ]]; then
+  if [[ -n "${REGISTRY_PASSWORD:-}" || -n "${REGISTRY_TOKEN:-}" ]]; then
     return 0
   fi
 
   if [[ ! -t 0 ]]; then
-    echo "REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
+    echo "REGISTRY_TOKEN or REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
     exit 1
   fi
 
-  printf 'Registry password for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
-  read -r -s REGISTRY_PASSWORD
+  printf 'Registry token for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
+  read -r -s REGISTRY_TOKEN
   printf '\n' >&2
-  export REGISTRY_PASSWORD
+  export REGISTRY_TOKEN
 }
 
 echo "Starting production services from pulled image ${APP_IMAGE}:${APP_VERSION}"