pull docker image

production/.env.docker.production.example

@@ -20,6 +20,8 @@ REGISTRY_PASSWORD=
 # The VPS cannot reach the VPN-only registry, so archive loading is required.
 IMAGE_ARCHIVE_DIR=/opt/docker-image-transfer
 IMAGE_ARCHIVE_REQUIRED=true
+# Optional VPN container name/id used by deploy-production.sh to fetch a missing image archive.
+# VPN_CONTAINER=
 
 # Database
 DATABASE_URL_FROM_POSTGRES=true

production/scripts/docker-prod-common.sh

@@ -69,7 +69,8 @@ load_prod_env_exports() {
     IMAGE_ARCHIVE_REQUIRED \
     REGISTRY_HOST \
     REGISTRY_USER \
-    REGISTRY_PASSWORD
+    REGISTRY_PASSWORD \
+    VPN_CONTAINER
   do
     export_env_value_if_unset "${key}"
   done
@@ -219,10 +220,13 @@ pull_prod_release_images() {
 
   if [[ "${IMAGE_ARCHIVE_REQUIRED:-false}" == "true" || "${IMAGE_ARCHIVE_REQUIRED:-0}" == "1" ]]; then
     echo "IMAGE_ARCHIVE_REQUIRED is enabled, but no archive for IMAGE_TAG=${IMAGE_TAG} was found in ${IMAGE_ARCHIVE_DIR:-<unset>}." >&2
+    echo "Direct docker pull is disabled in this mode." >&2
     echo "The VPS is configured for VPN/shared-folder image handoff. Create the archive first, for example:" >&2
     echo "  VPN_CONTAINER=<vpn-container-id-or-name> ./fetch-image-through-vpn.sh ${IMAGE_TAG}" >&2
     echo "Or let deploy fetch it before starting services:" >&2
     echo "  VPN_CONTAINER=<vpn-container-id-or-name> ./deploy-production.sh --fetch-through-vpn" >&2
+    echo "You can also set VPN_CONTAINER in .env.docker.production, then run:" >&2
+    echo "  ./deploy-production.sh" >&2
     exit 1
   fi