Fix for Nomad deploy.

.forgejo/workflows/deploy.yml

@@ -11,10 +11,9 @@
 #   REGISTRY_TOKEN   forgejo token, write:package scope (docker login)
 #   NOMAD_TOKEN      CI ACL token from deploy/nomad/README.md §5
 #   NOMAD_CACERT     contents of nomad-ca.crt from README §3
-# Repo variables (Settings → Variables) or edit the env block below:
+# Repo variables (Settings → Variables):
-#   REGISTRY_HOST    e.g. git.example.com
-#   REGISTRY_OWNER   forgejo user/org owning the images
 #   NOMAD_ADDR_HOST  services VPS public IP or DNS name (API :4646)
+# Registry location is baked below (resolved): p2gnl.mu-dungeon.xyz/admin-git
 
 name: deploy
 
@@ -23,8 +22,8 @@ on:
     branches: [main]
 
 env:
-  REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
+  REGISTRY_HOST: p2gnl.mu-dungeon.xyz
-  REGISTRY_OWNER: ${{ vars.REGISTRY_OWNER }}
+  REGISTRY_OWNER: admin-git
 
 jobs:
   build-and-deploy:

deploy/nomad/README.md

@@ -4,24 +4,27 @@ Single-node Nomad agent (server+client) running the app services
 (`api` + 5 workers) while stateful infra (postgres, redis, rabbitmq, minio),
 the nginx edge cascade, and observability stay on docker compose.
 
-Layout:
+Layout (also `nomad.service` for manual installs, `gen-tls.sh` for TLS):
 
 ```
 deploy/nomad/
 ├── nomad.hcl                      # agent config → /etc/nomad.d/nomad.hcl
+├── nomad.service                  # systemd unit (manual install route)
+├── gen-tls.sh                     # CA + server cert regeneration
 ├── policies/ci.hcl                # ACL policy for the Forgejo deploy token
 ├── contract-check.nomad.hcl       # job: api + worker groups
 └── README.md                      # this runbook
 ```
 
-Placeholders used below — substitute before running:
+Registry (resolved): Forgejo at `p2gnl.mu-dungeon.xyz`, owner `admin-git` —
+images are `p2gnl.mu-dungeon.xyz/admin-git/contract-check-<name>:<git-sha>`.
+
+Placeholders still used below — substitute before running:
 
 | Placeholder | Meaning |
 |---|---|
 | `<VPS_PUBLIC_IP>` | public IP of the services VPS |
 | `<FORGEJO_SERVER_IP>` | public IP of the Forgejo VPS (runner) |
-| `<FORGEJO_HOST>` | Forgejo hostname, e.g. `git.example.com` |
-| `<OWNER>` | Forgejo user/org owning the repo + images |
 
 ---
 
@@ -145,6 +148,26 @@ nomad acl bootstrap
 export NOMAD_TOKEN=<management-secret-id>
 ```
 
+Lost the management token? The 400 error from bootstrap tells you the reset
+index; use it to mint a fresh management token (invalidates the old one):
+
+```bash
+nomad acl bootstrap -reset-index <index-from-error>
+```
+
+Handy: keep the CLI env in a root-only file and source it on demand
+(never into .bashrc — tokens shouldn't leak to every shell):
+
+```bash
+umask 077
+cat > /root/.nomadrc <<'EOF'
+export NOMAD_ADDR=https://127.0.0.1:4646
+export NOMAD_CACERT=/etc/nomad.d/tls/nomad-ca.crt
+export NOMAD_TOKEN=<management-secret-id>
+EOF
+# per session: . /root/.nomadrc
+```
+
 Sanity checks:
 
 ```bash
@@ -174,9 +197,9 @@ defaults:
 ```bash
 nomad var put -in=json nomad/jobs/contract-check - <<'EOF'
 {
-  "registry_host": "<FORGEJO_HOST>",
+  "registry_host": "p2gnl.mu-dungeon.xyz",
-  "registry_owner": "<OWNER>",
+  "registry_owner": "admin-git",
-  "registry_user": "<OWNER>",
+  "registry_user": "admin-git",
   "registry_token": "<forgejo token with write:package scope>",
 
   "database_url": "postgresql+asyncpg://contract_check:<POSTGRES_PASSWORD>@172.17.0.1:15432/contract_check",
@@ -237,8 +260,6 @@ IMAGE_TAG=<git-sha> nomad job plan    deploy/nomad/contract-check.nomad.hcl
 IMAGE_TAG=<git-sha> nomad job run     deploy/nomad/contract-check.nomad.hcl
 ```
 
-Replace `<FORGEJO_HOST>`/`<OWNER>` in the job file image paths first.
-
 ```bash
 nomad job status contract-check          # groups, allocs, deployments
 nomad alloc logs -f <alloc-id>           # or: nomad logs -f contract-check

deploy/nomad/contract-check.nomad.hcl

@@ -81,7 +81,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
         args  = ["alembic", "upgrade", "head"]
 
         auth {
@@ -120,7 +120,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
         ports = ["http"]
 
         auth {
@@ -206,7 +206,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
 
         auth {
           usernameFile = "secrets/registry-user"
@@ -276,7 +276,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
 
         auth {
           usernameFile = "secrets/registry-user"
@@ -346,7 +346,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
 
         auth {
           usernameFile = "secrets/registry-user"
@@ -415,7 +415,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
 
         auth {
           usernameFile = "secrets/registry-user"
@@ -478,7 +478,7 @@ job "contract-check" {
       driver = "docker"
 
       config {
-        image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
+        image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
 
         auth {
           usernameFile = "secrets/registry-user"