kevinveenbirkenbachandClaude Opus 5.5 94115964b7 fix(web-app-matrix): pull MDAD images through the stack's registry proxy ...

The ansible flavor's runner starts its own docker daemon, and that daemon
pulled every MDAD image straight from Docker Hub and ghcr.io, past the
registry cache the stack's own daemon uses. MDAD pulls with
`pull: always`, so every bootstrap spent the shared anonymous Docker Hub
quota; locally a single run exhausted it and died with
"toomanyrequests" even for images already on disk.

The role now reads the proxy of the stack's docker.service. When there
is one, it mounts a docker.service drop-in into the runner with the same
HTTP_PROXY, HTTPS_PROXY and NO_PROXY, and pins the proxy host through
container_extra_hosts. When the stack's daemon trusts the registry
cache's MITM CA, the drop-in fetches that CA from the proxy and runs
update-ca-certificates before the inner daemon starts. Without a proxy
on the stack's daemon nothing changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-23 17:16:20 +02:00

..

ansible

fix(web-app-matrix): pull MDAD images through the stack's registry proxy

2026-10-23 17:16:20 +02:00

.nocheck

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00