From 2969b6145c79a132ce1f852ce6a69b2f1b55ca2a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Thu, 13 Aug 2026 21:35:37 +1000
Subject: [PATCH] ghp: use direct ghcr.io image + set GHP_ADMINS

Kubelet pulls hit ImagePullBackOff on the artifactapi ghcr pull-through
because ghcr.io's per-scope token auth is not proxied for anonymous
pulls. Switch the serve Deployment and migrate Job to the direct public
image (pulls anonymously) and set the admin to neoloc.

- deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- configmap.yaml: GHP_ADMINS -> neoloc
---
 apps/base/ghp/configmap.yaml   | 2 +-
 apps/base/ghp/deployment.yaml  | 2 +-
 apps/base/ghp/migrate-job.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/base/ghp/configmap.yaml b/apps/base/ghp/configmap.yaml
index f35f4ed..4cc2947 100644
--- a/apps/base/ghp/configmap.yaml
+++ b/apps/base/ghp/configmap.yaml
@@ -19,4 +19,4 @@ data:
   GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
   GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
   # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
-  GHP_ADMINS: "REPLACE_ME_ben_github_username"
+  GHP_ADMINS: "neoloc"
diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index ab4013b..c6c9c25 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
diff --git a/apps/base/ghp/migrate-job.yaml b/apps/base/ghp/migrate-job.yaml
index 443feef..ef8438c 100644
--- a/apps/base/ghp/migrate-job.yaml
+++ b/apps/base/ghp/migrate-job.yaml
@@ -37,7 +37,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           command: ["/ghp", "migrate"]
           env: