From ff1f7ec3a5a2b4741a2d6fdd06240d1be794e175 Mon Sep 17 00:00:00 2001
From: lyrathorpe <iam@emmathe.dev>
Date: Mon, 6 Jul 2026 14:34:41 +0100
Subject: [PATCH 1/2] feat: authenticate Renovate to the code.emmathe.dev
 container registry

Add a docker hostRule so Renovate can read/update digests for private images
(dlr, docs-site) pinned in the Terraform repo. Token via RENOVATE_REGISTRY_TOKEN env.
---
 config.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/config.js b/config.js
index d324141..a41d909 100644
--- a/config.js
+++ b/config.js
@@ -11,6 +11,18 @@ module.exports = {
     "minimumReleaseAge": "3 days",
     "labels": ["dependencies"],
     "reviewers": ["lyrathorpe"],
+    "hostRules": [
+        {
+            // Authenticate to the code.emmathe.dev container registry so Renovate can read and
+            // update digests for private images (e.g. code.emmathe.dev/lyrathorpe/whyisthedlrshut.today
+            // and .../docs-site, pinned in the Terraform repo). Token = a Gitea PAT with read:package;
+            // supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot.
+            "matchHost": "code.emmathe.dev",
+            "hostType": "docker",
+            "username": "renovate-bot",
+            "password": process.env.RENOVATE_REGISTRY_TOKEN
+        }
+    ],
     "prHourlyLimit": 10,
     "prConcurrentLimit": 10,
     "branchConcurrentLimit": 10,
-- 
2.54.0


From fd491cd2e344ceef11299dd90d546ebace522174 Mon Sep 17 00:00:00 2001
From: lyrathorpe <iam@emmathe.dev>
Date: Mon, 6 Jul 2026 14:44:54 +0100
Subject: [PATCH 2/2] fix: use the lyrathorpe account for registry read auth

---
 config.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/config.js b/config.js
index a41d909..6eb6db7 100644
--- a/config.js
+++ b/config.js
@@ -16,10 +16,11 @@ module.exports = {
             // Authenticate to the code.emmathe.dev container registry so Renovate can read and
             // update digests for private images (e.g. code.emmathe.dev/lyrathorpe/whyisthedlrshut.today
             // and .../docs-site, pinned in the Terraform repo). Token = a Gitea PAT with read:package;
-            // supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot.
+            // supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot (a PAT for
+            // the "lyrathorpe" account with read:package is sufficient; the registry images are its own).
             "matchHost": "code.emmathe.dev",
             "hostType": "docker",
-            "username": "renovate-bot",
+            "username": "lyrathorpe",
             "password": process.env.RENOVATE_REGISTRY_TOKEN
         }
     ],
-- 
2.54.0