Three paths from "Gitea-on-Unraid + a built repo" to "Unraid pulls
PXEForge by tag":
1. scripts/build-and-publish-unraid.sh — one-shot run on the Unraid
host. Clones from local Gitea (http://localhost:3000), runs the
iPXE fetch, docker build, docker login + push to Gitea's container
registry. Token never lands in the host's ~/.docker/config.json:
we set DOCKER_CONFIG to a tempdir and rm -rf it on exit. Token
never lands in `ps`/bash history either: --password-stdin.
2. deploy/unraid/pxeforge.xml — Docker template for the Unraid UI.
Forces NetworkType=host (PXE needs raw L2 broadcast — bridge mode
doesn't work, full stop), declares the right cap-add, and surfaces
PXEFORGE_PUBLIC_IP / PXEFORGE_LOG as configurable variables.
3. deploy/unraid/README.md — three documented paths (registry, compose
from cloned repo, docker load from tarball) and the gotchas that
actually bite (DHCP collision, host networking, perms on
/mnt/user/appdata, NFS-needs-CAP_SYS_ADMIN).
The build host I'm running on can't reach Unraid right now (LAN moved
to a different subnet) and the Cloudflare WAF skip rule on
gitea.milesward.dev doesn't yet cover /v2/* or /git-{upload,receive}-pack
paths, so the publish has to happen from the Unraid host itself for now.
This commit is what makes that one-shot.
Miles Ward
083277faae