Support registry token for VPN image pulls

production/.env.docker.production.example

@@ -14,6 +14,7 @@ APP_IMAGE=10.0.0.4/melabidi/carmanagement
 # External image registry host. REGISTRY_USER and REGISTRY_PASSWORD are only needed when docker login is required.
 REGISTRY_HOST=10.0.0.4
 REGISTRY_USER=melabidi
+REGISTRY_TOKEN=
 REGISTRY_PASSWORD=
 
 # Optional shared folder for image archives. Leave empty when the VPS can pull from the VPN registry directly.

production/README.md

@@ -40,7 +40,7 @@ At minimum, verify or rotate:
 If Docker needs to log in before pulling the app image, also set:
 
 - `REGISTRY_USER`
-- `REGISTRY_PASSWORD`
+- `REGISTRY_TOKEN`
 
 For the current VPN-reachable image registry, use direct pulls from the VPS.
 The registry is `10.0.0.4`, and the VPS WireGuard address is `10.0.0.1`.
@@ -49,6 +49,7 @@ The registry is `10.0.0.4`, and the VPS WireGuard address is `10.0.0.1`.
 APP_IMAGE=10.0.0.4/melabidi/carmanagement
 REGISTRY_HOST=10.0.0.4
 REGISTRY_USER=melabidi
+REGISTRY_TOKEN=<registry-token>
 IMAGE_ARCHIVE_DIR=
 IMAGE_ARCHIVE_REQUIRED=false
 ```

production/scripts/docker-prod-common.sh

@@ -117,10 +117,16 @@ load_prod_env_exports() {
     REGISTRY_HOST \
     REGISTRY_USER \
     REGISTRY_PASSWORD \
+    REGISTRY_TOKEN \
     VPN_CONTAINER
   do
     export_env_value_if_unset "${key}"
   done
+
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
 }
 
 validate_prod_env_file() {
@@ -228,6 +234,11 @@ require_release_image() {
 login_registry_if_configured() {
   local archive_disabled="${IMAGE_ARCHIVE_DISABLED:-false}"
 
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
+
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     if [[ "${archive_disabled}" != "true" && "${archive_disabled}" != "1" ]]; then
       echo "IMAGE_ARCHIVE_REQUIRED is enabled; skipping docker login."
@@ -258,7 +269,7 @@ login_registry_if_configured() {
   fi
 
   if [[ -z "${REGISTRY_HOST:-}" || -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
-    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD are all required when registry credentials are configured." >&2
+    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD or REGISTRY_TOKEN are required when registry credentials are configured." >&2
     exit 1
   fi
 

production/scripts/docker-prod-run-pulled-image.sh

@@ -55,19 +55,19 @@ prompt_registry_password_if_needed() {
     return 0
   fi
 
-  if [[ -n "${REGISTRY_PASSWORD:-}" ]]; then
+  if [[ -n "${REGISTRY_PASSWORD:-}" || -n "${REGISTRY_TOKEN:-}" ]]; then
     return 0
   fi
 
   if [[ ! -t 0 ]]; then
-    echo "REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
+    echo "REGISTRY_TOKEN or REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
     exit 1
   fi
 
-  printf 'Registry password for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
-  read -r -s REGISTRY_PASSWORD
+  printf 'Registry token for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
+  read -r -s REGISTRY_TOKEN
   printf '\n' >&2
-  export REGISTRY_PASSWORD
+  export REGISTRY_TOKEN
 }
 
 echo "Starting production services from pulled image ${APP_IMAGE}:${APP_VERSION}"

scripts/docker-prod-common.sh

@@ -111,10 +111,16 @@ load_prod_env_exports() {
     IMAGE_ARCHIVE_REQUIRED \
     REGISTRY_HOST \
     REGISTRY_USER \
-    REGISTRY_PASSWORD
+    REGISTRY_PASSWORD \
+    REGISTRY_TOKEN
   do
     export_env_value_if_unset "${key}"
   done
+
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
 }
 
 validate_prod_env_file() {
@@ -239,6 +245,11 @@ require_release_image() {
 }
 
 login_registry_if_configured() {
+  if [[ -z "${REGISTRY_PASSWORD:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
+    REGISTRY_PASSWORD="${REGISTRY_TOKEN}"
+    export REGISTRY_PASSWORD
+  fi
+
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled; skipping docker login."
     return 0
@@ -267,7 +278,7 @@ login_registry_if_configured() {
   fi
 
   if [[ -z "${REGISTRY_HOST:-}" || -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
-    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD are all required when registry credentials are configured." >&2
+    echo "REGISTRY_HOST, REGISTRY_USER, and REGISTRY_PASSWORD or REGISTRY_TOKEN are required when registry credentials are configured." >&2
     exit 1
   fi
 

scripts/docker-prod-run-pulled-image.sh

@@ -55,19 +55,19 @@ prompt_registry_password_if_needed() {
     return 0
   fi
 
-  if [[ -n "${REGISTRY_PASSWORD:-}" ]]; then
+  if [[ -n "${REGISTRY_PASSWORD:-}" || -n "${REGISTRY_TOKEN:-}" ]]; then
     return 0
   fi
 
   if [[ ! -t 0 ]]; then
-    echo "REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
+    echo "REGISTRY_TOKEN or REGISTRY_PASSWORD is not set and no interactive terminal is available for a prompt." >&2
     exit 1
   fi
 
-  printf 'Registry password for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
-  read -r -s REGISTRY_PASSWORD
+  printf 'Registry token for %s@%s: ' "${REGISTRY_USER}" "${REGISTRY_HOST}" >&2
+  read -r -s REGISTRY_TOKEN
   printf '\n' >&2
-  export REGISTRY_PASSWORD
+  export REGISTRY_TOKEN
 }
 
 echo "Starting production services from pulled image ${APP_IMAGE}:${APP_VERSION}"