From 29706867cd1b3a18b1118c0c3a3178db91bb1df0 Mon Sep 17 00:00:00 2001
From: lyrathorpe <iam@emmathe.dev>
Date: Mon, 6 Jul 2026 14:46:35 +0100
Subject: [PATCH] feat: authenticate Renovate to the private container registry
 (#54)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let the self-hosted Renovate bot authenticate to the `code.emmathe.dev` container registry so it can read and update digests for the **private** images pinned in the Terraform repo — `whyisthedlrshut.today` (dlr) and `docs-site`. Without this, Renovate can't reach those images and the digests never get bumped (they stay pinned but stale).

- Adds a `hostRules` entry: `matchHost: code.emmathe.dev`, `hostType: docker`, `username: renovate-bot`, `password: process.env.RENOVATE_REGISTRY_TOKEN`.
- Scoped to the docker datasource only — the existing Gitea platform/git auth is untouched.
- Digest updates already `automerge` (packageRules) and `pinDigests` is on (config:best-practices), so once auth works these images auto-bump.

**Owner action:** create the secret and expose it to the bot as the env var **`RENOVATE_REGISTRY_TOKEN`** — a Gitea PAT (user `renovate-bot`, or adjust the `username` in the rule) with **`read:package`** scope. That's the only thing needed.

The images are matched by the Terraform repo's existing `customManager` (docker datasource on `variables.tf`); no change needed there.

Reviewed-on: https://code.emmathe.dev/lyrathorpe/renovate-config/pulls/54
---
 config.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/config.js b/config.js
index d324141..6eb6db7 100644
--- a/config.js
+++ b/config.js
@@ -11,6 +11,19 @@ module.exports = {
     "minimumReleaseAge": "3 days",
     "labels": ["dependencies"],
     "reviewers": ["lyrathorpe"],
+    "hostRules": [
+        {
+            // Authenticate to the code.emmathe.dev container registry so Renovate can read and
+            // update digests for private images (e.g. code.emmathe.dev/lyrathorpe/whyisthedlrshut.today
+            // and .../docs-site, pinned in the Terraform repo). Token = a Gitea PAT with read:package;
+            // supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot (a PAT for
+            // the "lyrathorpe" account with read:package is sufficient; the registry images are its own).
+            "matchHost": "code.emmathe.dev",
+            "hostType": "docker",
+            "username": "lyrathorpe",
+            "password": process.env.RENOVATE_REGISTRY_TOKEN
+        }
+    ],
     "prHourlyLimit": 10,
     "prConcurrentLimit": 10,
     "branchConcurrentLimit": 10,