From da48054dc5dcf9da86d1768bcd4ed73fba727975 Mon Sep 17 00:00:00 2001
From: Max Mehl <mail@mehl.mx>
Date: Fri, 18 Sep 2026 22:02:28 +0200
Subject: [PATCH] fix: docker login on target host before compose pull
 (registry auth)

---
 .woodpecker/deploy.yaml | 2 +-
 bin/deploy-compose      | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.woodpecker/deploy.yaml b/.woodpecker/deploy.yaml
index bff2823..259d9a1 100644
--- a/.woodpecker/deploy.yaml
+++ b/.woodpecker/deploy.yaml
@@ -68,7 +68,7 @@ steps:
         $SSH_USER@$SSH_HOST chmod +x /tmp/poc-deploy/deploy-compose
       - |
         ssh -i /tmp/ssh/id_deploy -o StrictHostKeyChecking=accept-new \
-        $SSH_USER@$SSH_HOST /tmp/poc-deploy/deploy-compose
+        $SSH_USER@$SSH_HOST /tmp/poc-deploy/deploy-compose registry.ci.poc.mehl.mx $ZOT_USERNAME $ZOT_PASSWORD
       - |
         ssh -i /tmp/ssh/id_deploy -o StrictHostKeyChecking=accept-new \
         $SSH_USER@$SSH_HOST rm -f /tmp/poc-deploy/secrets.decrypted.env
diff --git a/bin/deploy-compose b/bin/deploy-compose
index 30bea95..9df5482 100755
--- a/bin/deploy-compose
+++ b/bin/deploy-compose
@@ -2,14 +2,22 @@
 # Runs a Compose deployment on the target host. Invoked remotely via SSH
 # after compose.yaml, release.env and secrets.decrypted.env have been
 # transferred to the same directory as this script.
+#
+# Usage: deploy-compose <registry> <username> <password>
 set -e
 
+REGISTRY="$1"
+ZOT_USERNAME="$2"
+ZOT_PASSWORD="$3"
+
 cd "$(dirname "$0")"
 
 set -a
 . ./release.env
 set +a
 
+echo "$ZOT_PASSWORD" | docker login "$REGISTRY" -u "$ZOT_USERNAME" --password-stdin
+
 docker compose \
   --project-directory . \
   -f compose.yaml \