From 97d5ecfcf0cf2ba949a5764643777f42203e74a9 Mon Sep 17 00:00:00 2001
From: root <melabidi@alrahmaisgl.org>
Date: Wed, 1 Jul 2026 22:12:49 -0400
Subject: [PATCH] pull docker image

---
 production/.env.docker.production.example | 2 ++
 production/scripts/docker-prod-common.sh  | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/production/.env.docker.production.example b/production/.env.docker.production.example
index b6dd441..2db0a80 100644
--- a/production/.env.docker.production.example
+++ b/production/.env.docker.production.example
@@ -20,6 +20,8 @@ REGISTRY_PASSWORD=
 # The VPS cannot reach the VPN-only registry, so archive loading is required.
 IMAGE_ARCHIVE_DIR=/opt/docker-image-transfer
 IMAGE_ARCHIVE_REQUIRED=true
+# Optional VPN container name/id used by deploy-production.sh to fetch a missing image archive.
+# VPN_CONTAINER=
 
 # Database
 DATABASE_URL_FROM_POSTGRES=true
diff --git a/production/scripts/docker-prod-common.sh b/production/scripts/docker-prod-common.sh
index 0e0bd33..ec5eec1 100755
--- a/production/scripts/docker-prod-common.sh
+++ b/production/scripts/docker-prod-common.sh
@@ -69,7 +69,8 @@ load_prod_env_exports() {
     IMAGE_ARCHIVE_REQUIRED \
     REGISTRY_HOST \
     REGISTRY_USER \
-    REGISTRY_PASSWORD
+    REGISTRY_PASSWORD \
+    VPN_CONTAINER
   do
     export_env_value_if_unset "${key}"
   done
@@ -219,10 +220,13 @@ pull_prod_release_images() {
 
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled, but no archive for IMAGE_TAG=${IMAGE_TAG} was found in ${IMAGE_ARCHIVE_DIR:-<unset>}." >&2
+    echo "Direct docker pull is disabled in this mode." >&2
     echo "The VPS is configured for VPN/shared-folder image handoff. Create the archive first, for example:" >&2
     echo "  VPN_CONTAINER=<vpn-container-id-or-name> ./fetch-image-through-vpn.sh ${IMAGE_TAG}" >&2
     echo "Or let deploy fetch it before starting services:" >&2
     echo "  VPN_CONTAINER=<vpn-container-id-or-name> ./deploy-production.sh --fetch-through-vpn" >&2
+    echo "You can also set VPN_CONTAINER in .env.docker.production, then run:" >&2
+    echo "  ./deploy-production.sh" >&2
     exit 1
   fi