From fa9f5f997fb205882f31ef21a8232f963de1ddce Mon Sep 17 00:00:00 2001
From: Aleksandr Meshchriakov <avm@sh-inc.ru>
Date: Wed, 22 Jul 2026 15:29:57 +0200
Subject: [PATCH] fix: authenticate customer deploy transport

---
 .gitea/workflows/deploy-customer-main.yml | 28 +++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/deploy-customer-main.yml b/.gitea/workflows/deploy-customer-main.yml
index 4c43f69..d0b88c1 100644
--- a/.gitea/workflows/deploy-customer-main.yml
+++ b/.gitea/workflows/deploy-customer-main.yml
@@ -132,25 +132,42 @@ jobs:
 
       - name: Deploy customer stack
         env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          GITEA_TOKEN: ${{ gitea.token }}
           CUSTOMER_DEPLOY_SSH_KEY: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY }}
           CUSTOMER_DEPLOY_SSH_KEY_B64: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY_B64 }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           set -euo pipefail
 
+          registry_user="${REGISTRY_USERNAME:-${REGISTRY_USER:-${GITHUB_ACTOR:-}}}"
+          registry_password="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-${GITEA_TOKEN:-}}}"
+          case "${registry_user}" in
+            *[!A-Za-z0-9._@-]*)
+              echo "Registry user contains unsupported characters" >&2
+              exit 1
+              ;;
+          esac
+
           home_dir="${HOME:-/root}"
           mkdir -p "${home_dir}/.ssh"
           key_path="${home_dir}/.ssh/customer_deploy_key"
-          if [ -n "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ]; then
+          if [ -f "/root/.ssh/ci-key" ]; then
+            cp "/root/.ssh/ci-key" "${key_path}"
+          elif [ -f "${home_dir}/.ssh/ci-key" ]; then
+            cp "${home_dir}/.ssh/ci-key" "${key_path}"
+          elif [ -n "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ]; then
             printf '%s' "${CUSTOMER_DEPLOY_SSH_KEY_B64}" | base64 -d > "${key_path}"
           elif [ -n "${DEPLOY_SSH_KEY:-}" ]; then
             printf '%s' "${DEPLOY_SSH_KEY}" | base64 -d > "${key_path}"
           elif [ -n "${CUSTOMER_DEPLOY_SSH_KEY:-}" ]; then
             printf '%s\n' "${CUSTOMER_DEPLOY_SSH_KEY}" > "${key_path}"
-          elif [ -f "${home_dir}/.ssh/ci-key" ]; then
-            cp "${home_dir}/.ssh/ci-key" "${key_path}"
           else
-            cp "/root/.ssh/ci-key" "${key_path}"
+            echo "Customer deploy SSH key is unavailable" >&2
+            exit 1
           fi
           chmod 600 "${key_path}"
 
@@ -169,4 +186,7 @@ jobs:
              flock -w 1800 /tmp/ecos-customer-deploy.lock /bin/sh -c 'cd /ecos && FORCE_PULL=1 COMPOSE_FILE=\"${CUSTOMER_COMPOSE_FILE}\" \"${CUSTOMER_DEPLOY_SCRIPT}\" && docker image prune -f'"
 
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "true"
+          printf '%s' "${registry_password}" \
+            | ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" \
+                "docker login '${CUSTOMER_REGISTRY_HOST}' -u '${registry_user}' --password-stdin"
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "${remote_command}"