From 8ae09f238b58668235cf9cec3c65b6f056da4766 Mon Sep 17 00:00:00 2001
From: Thomas Faour <tom@tfao.ca>
Date: Thu, 23 Jul 2026 17:10:21 -0400
Subject: [PATCH] Push server image to local registry instead of
 git.thumeit.com

Cloudflare (fronting git.thumeit.com) started rejecting image pushes
with 413 Payload Too Large once whiteboard mode's Node runtime + native
resvg bindings made the image significantly bigger than before. Switched
the build/push target to a LAN-local registry (10.0.0.246:3000) that has
nothing in front of it to hit that limit, and updated
docker-compose.yml.example to match.
---
 .gitea/workflows/server-docker-build.yml | 13 +++++++++----
 server/README.md                         | 16 +++++++++++-----
 server/docker-compose.yml.example        |  7 ++++++-
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/server-docker-build.yml b/.gitea/workflows/server-docker-build.yml
index 28fb4a2..0b52425 100644
--- a/.gitea/workflows/server-docker-build.yml
+++ b/.gitea/workflows/server-docker-build.yml
@@ -17,10 +17,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to Gitea Container Registry
+      - name: Log in to local Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: git.thumeit.com
+          # Pushed here instead of git.thumeit.com (still the source repo,
+          # just not the image registry anymore) -- since whiteboard mode
+          # added Node + native resvg bindings, the image grew past
+          # Cloudflare's payload-size limit in front of that host and
+          # every push 413'd. This LAN address has nothing in front of it.
+          registry: 10.0.0.246:3000
           username: tfaour
           password: ${{ secrets.REGISTRY_TOKEN }}
 
@@ -30,5 +35,5 @@ jobs:
           context: ./server
           push: true
           tags: |
-            git.thumeit.com/tfaour/espresso-frame-server:latest
-            git.thumeit.com/tfaour/espresso-frame-server:${{ gitea.sha }}
+            10.0.0.246:3000/tfaour/espresso-frame-server:latest
+            10.0.0.246:3000/tfaour/espresso-frame-server:${{ gitea.sha }}
diff --git a/server/README.md b/server/README.md
index d76df26..382e13c 100644
--- a/server/README.md
+++ b/server/README.md
@@ -277,11 +277,17 @@ Pages: `/` (routing hub), `/setup`, `/login`, `/claim`, `/settings`,
 
 Every push to `main` that touches `server/` triggers a Gitea Actions
 workflow (`.gitea/workflows/server-docker-build.yml`) that builds this
-image and pushes it to this repo's Gitea Container Registry at
-`git.thumeit.com/tfaour/espresso-frame-server`. `docker-compose.yml`
-(copied from `docker-compose.yml.example`, see Setup above) already
-points at that image, so a deploy host doesn't need this repo's build
-context at all -- just the compose file:
+image and pushes it to a LAN-local Gitea Container Registry at
+`10.0.0.246:3000/tfaour/espresso-frame-server` -- not the `git.thumeit.com`
+source repo itself; Cloudflare (fronting that host) started rejecting
+pushes with 413 Payload Too Large once whiteboard mode's Node/native-
+binding layers made the image significantly bigger, and this address
+has nothing in front of it to hit that limit. A deploy host reaching
+this registry needs Docker's `insecure-registries` configured for it if
+it's plain HTTP (see `daemon.json`) -- not something this repo controls.
+`docker-compose.yml` (copied from `docker-compose.yml.example`, see
+Setup above) already points at that image, so a deploy host doesn't
+need this repo's build context at all -- just the compose file:
 
 ```
 docker compose pull
diff --git a/server/docker-compose.yml.example b/server/docker-compose.yml.example
index 07e4f5a..4393be0 100644
--- a/server/docker-compose.yml.example
+++ b/server/docker-compose.yml.example
@@ -1,6 +1,11 @@
 services:
   espresso-frame-server:
-    image: git.thumeit.com/tfaour/espresso-frame-server:latest
+    # Pushed to a LAN-local registry, not git.thumeit.com -- see
+    # .gitea/workflows/server-docker-build.yml's comment (Cloudflare's
+    # payload-size limit in front of that host started rejecting pushes
+    # once whiteboard mode's Node/native-binding layers made the image
+    # much bigger).
+    image: 10.0.0.246:3000/tfaour/espresso-frame-server:latest
     build: .
     ports:
       - "8420:8420"