ci(deploy): migrate build to docker:28.4.0-dind + GitLab container registry

deploy/k8s/README.md

@@ -59,10 +59,9 @@ is CI's job to decide — it's an explicit, human-triggered event.
 | 7 | Ingress `vncmail-plus` | `base/ingress.yaml` (+ overlay patches for prod) | TLS host |
 
 **Image:** CI builds and pushes to `registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus`
-(tag `sha-<sha>` per deploy, moving pointers `dev-latest`/`prod-latest`). The
-`ghcr.io/brvncde-dotcom/vncmail-plus-dev` image referenced in `base/deployment.yaml`
-is a legacy default only — CI overrides it per-deploy via `kubectl set image`,
-so what's committed there never needs to track what's actually running.
+(tag `sha-<sha>` per deploy, moving pointer `dev-latest`). The generic `vncmail-plus`
+image name in `base/deployment.yaml` is a placeholder — kustomize's image-tag
+Component replaces it with the real registry path on every deploy.
 
 ---
 
@@ -98,15 +97,15 @@ pick up the fix):
 ```bash
 cd deploy/k8s/overlays/dev     # or overlays/prod, once real
 
-# a) Image-pull secret — the registry package is private.
-kubectl create secret docker-registry ghcr-pull \
+# a) Image-pull secret — the GitLab registry requires authentication.
+#    Use a project deploy token with `read_registry` scope, or the CI job
+#    token (short-lived — better for CI, not for long-running clusters).
+kubectl create secret docker-registry gitlab-registry \
   --namespace vncmail \
-  --docker-server=ghcr.io \
-  --docker-username=brvncde-dotcom \
-  --docker-password='<GITHUB_PAT_read:packages>' \
-  --docker-email=br@vnc.biz
-#    Once CI has cut over to registry.gitlab.vnc.biz, this becomes a
-#    docker-registry secret for that registry instead — see VNCMAIL-SETUP.md.
+  --docker-server=registry.gitlab.vnc.biz \
+  --docker-username=<deploy-token-name> \
+  --docker-password='<deploy-token-secret>' \
+  --docker-email=ci@vnc.biz
 
 # b) App config secret — copy the template, set a real SESSION_SECRET, apply.
 cp secret.example.yaml secret.yaml
@@ -117,8 +116,8 @@ kubectl apply -f secret.yaml
 kubectl apply -k .
 ```
 
-> Alternative to (a): make the registry package public, then delete the
-> `imagePullSecrets:` block from `base/deployment.yaml`.
+> Alternative to (a): make the GitLab container registry public for this
+> project, then delete the `imagePullSecrets:` block from `base/deployment.yaml`.
 
 After this one-time setup, routine deploys to `dev` happen automatically via
 CI on every push — see "Routine deploys go through CI now" above. This
@@ -170,7 +169,7 @@ ArgoCD re-sync.
 
 | Symptom | Cause / fix |
 |---------|-------------|
-| Pod `ImagePullBackOff` | `ghcr-pull` secret missing/expired, or package still private. Recreate the secret (§3a) or make the package public. |
+| Pod `ImagePullBackOff` | `gitlab-registry` secret missing/expired, or token lacks `read_registry`. Recreate the secret (§3a) or make the registry public. |
 | Pod `CrashLoopBackOff`, logs show `EACCES`/permission on `/app/data` | Volume not writable by uid 1001. `securityContext.fsGroup: 1001` is set in `base/deployment.yaml` — keep it; some storage drivers also need it on the PVC. |
 | PVC stuck `Pending` | Wrong `storageClassName` in `base/pvc.yaml`. Set it to one from `kubectl get sc`. |
 | Ingress has no address / no cert | Wrong `ingressClassName` or cert issuer. Match bulwark's (§2). Check `kubectl -n vncmail describe ingress vncmail-plus`. |

deploy/k8s/base/deployment.yaml

@@ -23,20 +23,18 @@ spec:
         fsGroup: 1001
         runAsUser: 1001
         runAsGroup: 1001
-      # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public
-      # (anonymous token pull succeeded) — no imagePullSecrets needed. This is
-      # deploy/k8s/README.md's own documented alternative to creating a
-      # ghcr-pull secret. Removed rather than left referencing a
-      # not-yet-created secret, which would otherwise block every pod from
-      # starting regardless of the image being public (kubelet fails to
-      # resolve a missing imagePullSecrets entry before it ever gets to
-      # deciding whether auth was actually required).
+      # The GitLab container registry is private by default. Nodes need a
+      # docker-registry secret named `gitlab-registry` in the target namespace.
+      # Create it once per environment during first-time setup
+      # (see deploy/k8s/README.md §3a).
+      imagePullSecrets:
+        - name: gitlab-registry
       containers:
         - name: vncmail-plus
-          # Default/legacy value — CI overrides the image per-deploy via
-          # `kustomize edit set image`, so what's committed here never goes
-          # stale. For a one-off manual apply, pin a digest instead of :latest.
-          image: ghcr.io/brvncde-dotcom/vncmail-plus-dev:latest
+          # Generic placeholder — the real image name + tag are injected by the
+          # image-tag kustomize Component on every deploy (see
+          # overlays/*/image-tag/kustomization.yaml, rewritten by CI).
+          image: vncmail-plus:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 3000

deploy/k8s/overlays/dev/image-tag/kustomization.yaml

@@ -6,6 +6,6 @@
 apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 images:
-  - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
-    newName: ghcr.io/brvncde-dotcom/vncmail-plus-dev
+  - name: vncmail-plus
+    newName: registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus
     newTag: sha-147660a

deploy/k8s/overlays/dev/patch-image-pull-policy.yaml

@@ -4,19 +4,6 @@
 # is pure waste - the content behind that tag can never change, so re-pulling
 # it on every pod start only adds a registry round-trip and a hard dependency
 # on the registry being reachable at scheduling time.
-#
-# It is also load-bearing right now: until CI can actually push (GitLab's
-# registry vhost serves Rails, not the registry - see .gitlab-ci.yml's
-# "Registry history" note), sha- tagged images are side-loaded straight into
-# each node's containerd:
-#
-#   docker save --platform linux/amd64 -o vncmail.tar <image>:<tag>
-#   scp vncmail.tar dev-k8s-N:/tmp/ && ssh dev-k8s-N \
-#     'microk8s ctr images import /tmp/vncmail.tar'
-#
-# imported to ALL of dev-k8s-1/2/3 so the pod can schedule anywhere. With
-# Always, kubelet would ignore that local image and fail on a registry pull
-# for a tag the registry has never seen.
 apiVersion: apps/v1
 kind: Deployment
 metadata:

deploy/k8s/overlays/prod/image-tag/kustomization.yaml

@@ -7,6 +7,6 @@
 apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 images:
-  - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
+  - name: vncmail-plus
     newName: registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus
     newTag: not-yet-promoted