feat(cache): derive the proxy registry allowlist from the role images

rpardini/docker-registry-proxy SSL-bumps and caches only the registries its
REGISTRIES env names; Docker Hub is hardcoded in its entrypoint. A registry the
list omits is still tunnelled, so its pulls succeed at full upstream cost and
leave no line in the proxy log.

The list was the image default and omitted mcr.microsoft.com, registry.gitlab.com
and registry.opencode.de, all three of which roles declare images on. Deriving it
from every image: in roles/**/meta/services.yml keeps it complete by construction.
BASE carries the two registries that were configured before and that no role image
names, so the switch to a derived list cannot drop them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

compose/cache.override.yml

@@ -9,6 +9,7 @@ services:
     environment:
       ENABLE_MANIFEST_CACHE: "true"
       AUTH_REGISTRIES: ""
+      REGISTRIES: ${INFINITO_CACHE_REGISTRIES:?Run 'make dotenv' to generate the .env single source of truth}
       CACHE_MAX_SIZE: "${INFINITO_CACHE_REGISTRY_MAX_SIZE:?Run 'make dotenv' to generate the .env single source of truth}"
       DISABLE_IPV6: "true"
     volumes:

utils/env/handlers/__init__.py

@@ -37,6 +37,7 @@ from .infinito.cache import conf as cache_conf
 from .infinito.cache import hosts as cache_hosts
 from .infinito.cache import http_hosts as cache_http_hosts
 from .infinito.cache import paths as cache_paths
+from .infinito.cache import registries as cache_registries
 from .infinito.cache import stack as cache_stack
 from .infinito.cache import tls as cache_tls
 from .infinito.cache import upstreams as cache_upstreams
@@ -91,6 +92,7 @@ ORDERED_HANDLERS = [
     cache_http_hosts,
     cache_tls,
     cache_upstreams,
+    cache_registries,
     cache_stack,
     cache_paths,
     tor_socks_port,

utils/env/handlers/infinito/cache/registries.py

@@ -0,0 +1,49 @@
+"""INFINITO_CACHE_REGISTRIES: the registries the pull-through proxy bumps.
+
+``rpardini/docker-registry-proxy`` SSL-bumps and caches only the registries
+named in its ``REGISTRIES`` env; Docker Hub is hardcoded in its entrypoint. A
+registry the list omits is still tunnelled, so its pulls succeed at full
+upstream cost and leave no line in the proxy log - the omission is invisible
+until someone times a deploy.
+
+Deriving the list from every ``image:`` in ``roles/**/meta/services.yml``
+keeps it complete by construction: a role that adopts an image from a new
+registry brings that registry with it. ``BASE`` carries the registries that
+were configured before this was derived and that no role image names, so
+turning the list into a derived one cannot silently drop them.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from utils import PROJECT_ROOT
+from utils.docker.image.discovery import iter_role_images
+from utils.docker.image.ref import DOCKER_HUB_REGISTRIES
+
+if TYPE_CHECKING:
+    from utils.env.builder import BuildContext, EnvBuilder
+
+KEY = "INFINITO_CACHE_REGISTRIES"
+COMMENT = "Registries the pull-through proxy SSL-bumps and caches; derived from every role image, Docker Hub is implicit."
+
+BASE = frozenset({"gcr.io", "registry.k8s.io"})
+
+
+def declared_registries() -> list[str]:
+    """Return every registry the cache must bump, sorted.
+
+    Docker Hub is excluded: the proxy's entrypoint always bumps
+    ``registry-1.docker.io`` and ``auth.docker.io``, and naming a Hub alias
+    here would only duplicate that.
+    """
+    found = {
+        image.registry
+        for image in iter_role_images(PROJECT_ROOT)
+        if image.registry and image.registry not in DOCKER_HUB_REGISTRIES
+    }
+    return sorted(found | BASE)
+
+
+def apply(eb: EnvBuilder, ctx: BuildContext) -> None:
+    eb.set(KEY, " ".join(declared_registries()), comment=COMMENT)