.gitea/workflows/registry-build-deploy.yml

@@ -3,21 +3,23 @@
 # Triggers: push to master/main, or manual workflow_dispatch.
 #
 # Repository Variables (Settings → Actions → Variables):
-#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
+#   REGISTRY_HOST        Docker registry host:port (no http/https). Same PC as Gitea → 127.0.0.1:3000
 #   REGISTRY_OWNER       Gitea user or org that owns the packages
 #   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
 #   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
 #
 # Optional:
 #   STAGING_HTTP_PORT    host port for nginx (default 8088)
-#   CLONE_HOST           when runner is on the same host as Gitea and public IP fails locally,
+#   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
-#                        set to 127.0.0.1:3000 (no http:// — same style as REGISTRY_HOST)
+#
+# Same Windows PC runs Gitea + runner + deploy: use 127.0.0.1:3000 for REGISTRY_HOST and CLONE_HOST.
+# PUBLIC_BASE_URL stays the public IP:8088 so users open the app from the network.
 #
 # Repository Secrets (Settings → Actions → Secrets):
 #   REGISTRY_USERNAME    Gitea username for docker login
 #   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
 #
-# Docker on runner: add REGISTRY_HOST to insecure-registries (HTTP registry), then restart Docker.
+# Docker on runner: add registry hosts to insecure-registries, e.g. ["127.0.0.1:3000","178.131.50.201:3000"]
 #
 # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
 

infrastructure/STAGING-DEPLOY.md

@@ -56,7 +56,7 @@ Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflow
 
 ```json
 {
-  "insecure-registries": ["178.131.50.201:3000", "127.0.0.1:3000"]
+  "insecure-registries": ["127.0.0.1:3000", "178.131.50.201:3000"]
 }
 ```
 
@@ -66,13 +66,24 @@ Apply & restart Docker.
 
 Download [act_runner](https://gitea.com/gitea/act_runner/releases) → e.g. `C:\gitea-runner\act_runner.exe`.
 
+**Important — runner level:** the registration token decides which repos can use the runner.
+
+| Token from | Runner level | Works for `admin/dyolink`? |
+|------------|--------------|----------------------------|
+| **Site Administration → Actions → Runners** | Instance (global) | Yes (recommended) |
+| **Repo → Settings → Actions → Runners** | Repository | Yes |
+| **User profile → Settings → Actions → Runners** | Individual | Often **no** — jobs stay queued with “no matching online runner” |
+
+If your runner shows **Type: Individual** in Gitea but jobs never start, delete it and re-register with an **instance** or **repository** token (table above).
+
 Register (use **localhost** when Gitea runs on the same PC — public IP often fails locally):
 
 ```powershell
 cd C:\gitea-runner
+# Stop daemon first (Ctrl+C) if running
 .\act_runner.exe register `
   --instance "http://127.0.0.1:3000" `
-  --token "<registration-token-from-gitea>" `
+  --token "<token-from-Site-Admin-OR-repo-Runners-page>" `
   --name "windows-staging" `
   --labels "windows:host"
 ```
@@ -83,7 +94,7 @@ Start (leave running, or install as a Windows service later):
 .\act_runner.exe daemon
 ```
 
-Gitea → repo → **Settings → Actions → Runners** should show **Online**.
+**Verify:** open **your repo** → **Settings → Actions → Runners** — `windows-staging` must appear here as **Idle/Online** (not only under user settings).
 
 **Requires:** `git` on PATH (for workflow checkout step).
 
@@ -110,11 +121,11 @@ Rules:
 
 | Name | Example | Notes |
 |------|---------|--------|
-| `REGISTRY_HOST` | `178.131.50.201:3000` | No `http://` |
+| `REGISTRY_HOST` | `127.0.0.1:3000` | **Same PC as Gitea:** use `127.0.0.1:3000`, not the public IP. Public IP often fails from the laptop itself. |
 | `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
-| `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | No trailing `/` |
+| `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | How **users** open staging in a browser (public IP OK) |
 | `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
-| `CLONE_HOST` | `127.0.0.1:3000` | When runner and Gitea are same machine |
+| `CLONE_HOST` | `127.0.0.1:3000` | Git clone when runner and Gitea share one host |
 | `STAGING_HTTP_PORT` | `8088` | Optional (8088 is default) |
 
 **Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.
@@ -208,10 +219,11 @@ On the Windows host, from repo `infrastructure/`:
 
 | Symptom | Fix |
 |---------|-----|
-| `no matching online runner with label` | Start `act_runner.exe daemon`; confirm runner is **Online** in Gitea. `runs-on` must match a runner label exactly — workflow uses `windows` (register with `windows:host`). |
+| `no matching online runner with label` | Runner **offline** → start `act_runner.exe daemon`. Or wrong **runner level** → re-register with token from **Site Administration → Actions → Runners** or **repo → Settings → Actions → Runners** (not user profile). Confirm runner appears on **repo** Runners page as Online. |
 | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
 | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
-| `server gave HTTP response to HTTPS client` | Add registry to Docker **insecure-registries**, restart Docker |
+| `docker login` / push denied, `connectex... refused` on public IP | **Same PC as Gitea:** set `REGISTRY_HOST=127.0.0.1:3000` (not `178.131.50.201:3000`). Add `127.0.0.1:3000` to Docker insecure-registries. Keep `PUBLIC_BASE_URL` as public IP for the browser. |
+| `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
 | `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
 | `docker login` denied | Token needs package permissions; check username/secret |
 | Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |