Update deploy job.

deploy/nomad/README.md

@@ -184,7 +184,7 @@ nomad server members    # self as leader
 nomad node status       # client ready, docker driver detected
 ```
 
-## 5. CI policy + token + registry variables
+## 5. CI policy + token + registry login + variables
 
 ```bash
 # policy for the deploy token
@@ -196,6 +196,15 @@ nomad acl token create -name forgejo-ci -policy ci
 # → AccessorID + SecretID. Forgejo repo secret: NOMAD_TOKEN = SecretID
 ```
 
+Registry login on the VPS — Nomad 1.9's docker driver predates the
+`usernameFile`/`passwordFile` auth fields, so the job file has NO `auth`
+block. Instead, log in once on the host (the agent runs as root and uses
+the host docker daemon → all task pulls read root's docker config):
+
+```bash
+docker login p2gnl.mu-dungeon.xyz -u admin-git -p <forgejo token, read:package>
+```
+
 Registry credentials and app secrets — the job file templates ALL of these
 from `nomad/jobs/contract-check` (missing keys render empty; define every
 key once). Connection strings point at the docker0 host gateway

deploy/nomad/contract-check.nomad.hcl

@@ -84,19 +84,7 @@ job "contract-check" {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
         args  = ["alembic", "upgrade", "head"]
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
-      }
-
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
       }
 
       template {
@@ -123,10 +111,7 @@ job "contract-check" {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
         ports = ["http"]
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -136,15 +121,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
-
       # All connection strings + app secrets, agent-rendered from Nomad
       # Variables. Missing keys render empty — define them all once (README §5).
       template {
@@ -208,10 +184,7 @@ job "contract-check" {
       config {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -221,14 +194,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
       template {
         destination = "secrets/env"
         env         = true
@@ -278,10 +243,7 @@ job "contract-check" {
       config {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -291,14 +253,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
       template {
         destination = "secrets/env"
         env         = true
@@ -348,10 +302,7 @@ job "contract-check" {
       config {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -361,14 +312,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
       template {
         destination = "secrets/env"
         env         = true
@@ -417,10 +360,7 @@ job "contract-check" {
       config {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -430,14 +370,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
       template {
         destination = "secrets/env"
         env         = true
@@ -480,10 +412,7 @@ job "contract-check" {
       config {
         image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
 
-        auth {
+        # registry auth: host-level `docker login` on the VPS (README §5)
-          usernameFile = "secrets/registry-user"
-          passwordFile = "secrets/registry-pass"
-        }
       }
 
       env {
@@ -493,14 +422,6 @@ job "contract-check" {
         APP_VERSION  = "{{ env \"IMAGE_TAG\" }}"
       }
 
-      template {
-        destination = "secrets/registry-user"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
-      }
-      template {
-        destination = "secrets/registry-pass"
-        data        = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
-      }
       template {
         destination = "secrets/env"
         env         = true