Pull the image from the Gitea registry instead of building locally on admin.yttrx.com

CLAUDE.md

@@ -28,8 +28,8 @@ follows within `SUSPICIOUS_GRACE_HOURS` of going live. See README.md's
 | Where | What |
 |---|---|
 | Workstation | Source of truth: `~/yttrx-welcomebot/` (this repo) |
-| `git.blairhaus.net/yttrx-welcomebot.git` | `origin` remote (HTTP Basic Auth, `GIT_AUTH_USER`/`GIT_AUTH_PASS` in `~/docker/.env` on admin — same shared cred as every other git.blairhaus.net repo, embedded in the remote URL). No CI (`.ci/run.sh`) configured — deploy is a manual `git pull` on admin.yttrx.com, not push-triggered. |
+| `git.blairhaus.net/yttrx-welcomebot.git` | `origin` remote (HTTP Basic Auth, `GIT_AUTH_USER`/`GIT_AUTH_PASS` in `~/docker/.env` on admin — same shared cred as every other git.blairhaus.net repo, embedded in the remote URL). `.gitea/workflows/docker-build-push.yml` runs on every push to `main` (added 2026-07-06): builds the image and pushes `gitea.blairhaus.net/pmb/yttrx-welcomebot:latest` + `:<sha>` to the Gitea container registry. |
-| `admin.yttrx.com` | Deploy target: `/root/yttrx-welcomebot/` is a **git checkout** of the above (converted from an rsync-deployed tree 2026-07-02), Docker container `yttrx-welcomebot` on `127.0.0.1:8087`, nginx site `hooks` → `hooks.yttrx.com`. `ssh admin.yttrx.com` logs in as **root**. Compose is **`docker-compose` v1.29.2** (hyphenated, not `docker compose`). |
+| `admin.yttrx.com` | Deploy target: `/root/yttrx-welcomebot/` is a **git checkout** of the above (converted from an rsync-deployed tree 2026-07-02), Docker container `yttrx-welcomebot` on `127.0.0.1:8087`, nginx site `hooks` → `hooks.yttrx.com`. `ssh admin.yttrx.com` logs in as **root**. Compose is **`docker-compose` v1.29.2** (hyphenated, not `docker compose`). `docker-compose.yml` now pulls `image: gitea.blairhaus.net/pmb/yttrx-welcomebot:latest` (switched from `build: .` 2026-07-06) — `root`'s `~/.docker/config.json` on this box holds a read-only (`read:package`) Gitea PAT for the pull; deploy is still `git pull` (picks up compose/`.env`-var changes) but the image itself now comes from the registry, not a local build. |
 | `mammut` (`ssh mammut`) | The Mastodon instance. `tootctl`/Rails run inside the `live-web-1` container. Bot accounts + tokens live here. |
 
 Full ops history is in secondbrain `yttrx-documentation/changelog.md`; the
@@ -76,10 +76,13 @@ ssh admin.yttrx.com 'cd /root/yttrx-welcomebot && chown -R waffles:waffles . &&
 ssh admin.yttrx.com 'cd /root/yttrx-welcomebot && \
   grep -q "^NEW_VAR=" .env || echo "NEW_VAR=value" >> .env'
 
-# 6. Rebuild + restart (named volume welcomebot-data persists the dedup db;
+# 6. Pull the freshly-CI-built image and restart (named volume welcomebot-data
-#    the volume name is derived from the directory basename, which is
+#    persists the dedup db; the volume name is derived from the directory
-#    unchanged, so it survived the rsync -> git-checkout conversion)
+#    basename, which is unchanged, so it survived the rsync -> git-checkout
-ssh admin.yttrx.com 'cd /root/yttrx-welcomebot && docker-compose up -d --build'
+#    conversion). Wait for the .gitea/workflows/docker-build-push.yml run to
+#    finish first (push -> CI builds+pushes :latest) or this just re-pulls the
+#    previous tag.
+ssh admin.yttrx.com 'cd /root/yttrx-welcomebot && docker-compose pull && docker-compose up -d'
 ```
 
 Rollback is now `git checkout <previous-sha> -- .` (or `git revert`) instead of

docker-compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   welcomebot:
-    build: .
+    image: gitea.blairhaus.net/pmb/yttrx-welcomebot:latest
     container_name: yttrx-welcomebot
     restart: unless-stopped
     env_file: .env