fix docker url for making connection with gitea.

.gitea/workflows/registry-build-deploy.yml

@@ -12,8 +12,13 @@
 #   STAGING_HTTP_PORT    host port for nginx (default 8088)
 #   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
 #
-# Same Windows PC runs Gitea + runner + deploy: use 127.0.0.1:3000 for REGISTRY_HOST and CLONE_HOST.
+# Same Windows PC runs Gitea + runner + deploy:
-# PUBLIC_BASE_URL stays the public IP:8088 so users open the app from the network.
+#   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
+#   REGISTRY_HOST        → host.docker.internal:3000  (docker commands run inside Docker Desktop VM)
+#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/
+#   PUBLIC_BASE_URL      → public IP:8088 (browser URL for staging app)
+#
+# Add host.docker.internal:3000 to Docker Desktop insecure-registries.
 #
 # Repository Secrets (Settings → Actions → Secrets):
 #   REGISTRY_USERNAME    Gitea username for docker login

infrastructure/STAGING-DEPLOY.md

@@ -56,13 +56,31 @@ Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflow
 
 ```json
 {
-  "insecure-registries": ["127.0.0.1:3000", "178.131.50.201:3000"]
+  "insecure-registries": [
+    "host.docker.internal:3000",
+    "127.0.0.1:3000",
+    "178.131.50.201:3000",
+    "192.168.1.100:3000"
+  ]
 }
 ```
 
-Apply & restart Docker.
+Apply & restart Docker Desktop.
 
-### 2. Gitea Actions runner
+**Why `host.docker.internal`?** Docker Desktop runs in a Linux VM. `docker login` runs from that VM — `127.0.0.1:3000` is the VM, not Gitea on Windows.
+
+### 2b. Gitea `app.ini` — match registry URL
+
+Edit `C:\gitea\custom\conf\app.ini`:
+
+```ini
+[server]
+ROOT_URL = http://host.docker.internal:3000/
+```
+
+Restart Gitea. Gitea uses `ROOT_URL` for Docker registry auth redirects.
+
+### 2c. Gitea Actions runner
 
 Download [act_runner](https://gitea.com/gitea/act_runner/releases) → e.g. `C:\gitea-runner\act_runner.exe`.
 
@@ -121,11 +139,11 @@ Rules:
 
 | Name | Example | Notes |
 |------|---------|--------|
-| `REGISTRY_HOST` | `127.0.0.1:3000` | **Same PC as Gitea:** use `127.0.0.1:3000`, not the public IP. Public IP often fails from the laptop itself. |
+| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Also set Gitea `ROOT_URL` to match (see below). |
 | `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
 | `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | How **users** open staging in a browser (public IP OK) |
 | `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
-| `CLONE_HOST` | `127.0.0.1:3000` | Git clone when runner and Gitea share one host |
+| `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) |
 | `STAGING_HTTP_PORT` | `8088` | Optional (8088 is default) |
 
 **Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.
@@ -222,7 +240,8 @@ On the Windows host, from repo `infrastructure/`:
 | `no matching online runner with label` | Runner **offline** → start `act_runner.exe daemon`. Or wrong **runner level** → re-register with token from **Site Administration → Actions → Runners** or **repo → Settings → Actions → Runners** (not user profile). Confirm runner appears on **repo** Runners page as Online. |
 | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
 | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
-| `docker login` / push denied, `connectex... refused` on public IP | **Same PC as Gitea:** set `REGISTRY_HOST=127.0.0.1:3000` (not `178.131.50.201:3000`). Add `127.0.0.1:3000` to Docker insecure-registries. Keep `PUBLIC_BASE_URL` as public IP for the browser. |
+| `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
+| `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
 | `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
 | `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
 | `docker login` denied | Token needs package permissions; check username/secret |