git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06 — distributed scraper botnet), so a fresh Pi can no longer anonymously docker pull the node images or curl install.sh. Owner picked option 3: on a v* tag, build the three node images and push them to a public registry; source + the private Gitea registry stay walled.
This workflow is wired but INERT. The publish job is gated on vars.NODE_PUBLIC_PUBLISH == 'true' (unset), so it triggers on tags and skips. No if: false — the variable is the switch.
Builds all three (edge-node, icecast, op25-client) arm64 via a matrix, reuses the existing Gitea :buildcache refs so op25 doesn't recompile from scratch, pushes <ns>/drb-<name>:<version> + :latest.
Not turning it on now — still building the core. Follow-on when self-serve node install is actually needed: also serve install.sh + a repo tarball publicly, and point install.sh / the mint panel at the public image names.
`git.vpn.cusano.net` is now behind `REQUIRE_SIGNIN_VIEW` (INCIDENT-2026-09-06 — distributed scraper botnet), so a fresh Pi can no longer anonymously `docker pull` the node images or `curl` install.sh. Owner picked option 3: on a `v*` tag, build the three node images and push them to a **public** registry; source + the private Gitea registry stay walled.
**This workflow is wired but INERT.** The `publish` job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'` (unset), so it triggers on tags and skips. No `if: false` — the variable is the switch.
To enable later (documented in the file header):
- vars: `NODE_PUBLIC_PUBLISH=true`, `PUBLIC_REGISTRY` (e.g. `ghcr.io`), `PUBLIC_NAMESPACE`
- secrets: `PUBLIC_REGISTRY_USER`, `PUBLIC_REGISTRY_TOKEN`
Builds all three (edge-node, icecast, op25-client) arm64 via a matrix, reuses the existing Gitea `:buildcache` refs so op25 doesn't recompile from scratch, pushes `<ns>/drb-<name>:<version>` + `:latest`.
Not turning it on now — still building the core. Follow-on when self-serve node install is actually needed: also serve `install.sh` + a repo tarball publicly, and point `install.sh` / the mint panel at the public image names.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06),
so a fresh Pi can no longer anonymously `docker pull` the node images or
fetch install.sh. Plan (owner, option 3): on a `v*` tag, build the three
node images (edge-node, icecast, op25-client, arm64) and push them to a
PUBLIC registry; source and the private Gitea registry stay walled.
This workflow is wired but INERT — the job is gated on
`vars.NODE_PUBLIC_PUBLISH == 'true'`, which is unset. It triggers on tags
and skips. Enabling is three repo variables + two secrets, documented in the
file header; no code change. Reuses the existing Gitea buildcache refs so
op25 doesn't recompile from scratch.
Not turning it on now — still building the core.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
logan
merged commit a53000a092 into main2026-09-06 23:49:03 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
git.vpn.cusano.netis now behindREQUIRE_SIGNIN_VIEW(INCIDENT-2026-09-06 — distributed scraper botnet), so a fresh Pi can no longer anonymouslydocker pullthe node images orcurlinstall.sh. Owner picked option 3: on av*tag, build the three node images and push them to a public registry; source + the private Gitea registry stay walled.This workflow is wired but INERT. The
publishjob is gated onvars.NODE_PUBLIC_PUBLISH == 'true'(unset), so it triggers on tags and skips. Noif: false— the variable is the switch.To enable later (documented in the file header):
NODE_PUBLIC_PUBLISH=true,PUBLIC_REGISTRY(e.g.ghcr.io),PUBLIC_NAMESPACEPUBLIC_REGISTRY_USER,PUBLIC_REGISTRY_TOKENBuilds all three (edge-node, icecast, op25-client) arm64 via a matrix, reuses the existing Gitea
:buildcacherefs so op25 doesn't recompile from scratch, pushes<ns>/drb-<name>:<version>+:latest.Not turning it on now — still building the core. Follow-on when self-serve node install is actually needed: also serve
install.sh+ a repo tarball publicly, and pointinstall.sh/ the mint panel at the public image names.🤖 Generated with Claude Code