fix: switch Docker build to plain docker build/push with insecure registry

- Drop buildx (setup-buildx-action, build-push-action)
- Use insecure HTTP registry with SIGHUP daemon reload
- Use org-level PAT secrets for registry auth

.gitea/workflows/build-push.yaml

@@ -121,42 +121,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config-inline: |
-            [registry."gitea-http.gitea.svc.cluster.local:3000"]
-              http = true
-              insecure = true
-
-      - name: Login to Docker Hub
-        if: vars.DOCKERHUB_USERNAME != ''
-        uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Configure Docker for insecure registry
+      - name: Configure insecure registry
         run: |
           sudo mkdir -p /etc/docker
           echo '{"insecure-registries": ["${{ env.REGISTRY_HOST }}"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker || sudo service docker restart || true
-          sleep 2
+          sudo kill -SIGHUP "$(pidof dockerd)" || true
+          sleep 3
 
       - name: Login to Gitea Registry
-        run: |
-          AUTH=$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
-          mkdir -p ~/.docker
-          cat > ~/.docker/config.json << EOF
-          {
-            "auths": {
-              "${{ env.REGISTRY_HOST }}": {
-                "auth": "$AUTH"
-              }
-            }
-          }
-          EOF
-          echo "Auth configured for ${{ env.REGISTRY_HOST }}"
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Login to Docker Hub
+        if: vars.DOCKERHUB_USERNAME != ''
+        run: echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ vars.DOCKERHUB_USERNAME }}" --password-stdin
 
       - name: Extract metadata
         id: meta
@@ -169,14 +146,21 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+        run: |
+          # Build with all tags
+          TAGS=""
+          while IFS= read -r tag; do
+            [ -n "$tag" ] && TAGS="$TAGS -t $tag"
+          done <<< "${{ steps.meta.outputs.tags }}"
+          docker build $TAGS \
+            --label "org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}" \
+            --label "org.opencontainers.image.revision=${{ gitea.sha }}" \
+            .
+          # Push each tag
+          while IFS= read -r tag; do
+            [ -n "$tag" ] && docker push "$tag"
+          done <<< "${{ steps.meta.outputs.tags }}"
+
 
   notify:
     name: Notify

Dockerfile

@@ -4,11 +4,14 @@ FROM golang:1.25-alpine AS builder
 WORKDIR /app
 
 # Install ca-certificates for HTTPS
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates git
+
+ENV GOPRIVATE=git.daviestechlabs.io
+ENV GONOSUMCHECK=git.daviestechlabs.io
 
 # Copy go mod files
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=secret,id=netrc,target=/root/.netrc go mod download
 
 # Copy source code
 COPY . .

e2e_test.go

@@ -12,7 +12,7 @@ import (
 	"testing"
 
 	"git.daviestechlabs.io/daviestechlabs/handler-base/messages"
-	"github.com/vmihailenco/msgpack/v5"
+	"google.golang.org/protobuf/proto"
 )
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -67,21 +67,21 @@ func TestSynthesisE2E_StreamChunks(t *testing.T) {
 
 		// Verify typed chunk struct
 		msg := messages.TTSAudioChunk{
-			SessionID:   "test-session",
-			ChunkIndex:  chunkIdx,
-			TotalChunks: totalChunks,
+			SessionId:   "test-session",
+			ChunkIndex:  int32(chunkIdx),
+			TotalChunks: int32(totalChunks),
 			Audio:       chunk,
 			IsLast:      isLast,
 			SampleRate:  24000,
 		}
 
 		// Round-trip through msgpack
-		data, _ := msgpack.Marshal(&msg)
+		data, _ := proto.Marshal(&msg)
 		var decoded messages.TTSAudioChunk
-		_ = msgpack.Unmarshal(data, &decoded)
+		_ = proto.Unmarshal(data, &decoded)
 
-		if decoded.SessionID != "test-session" {
-			t.Errorf("chunk %d: session = %v", chunkIdx, decoded.SessionID)
+		if decoded.SessionId != "test-session" {
+			t.Errorf("chunk %d: session = %v", chunkIdx, decoded.SessionId)
 		}
 		if decoded.IsLast != isLast {
 			t.Errorf("chunk %d: is_last = %v, want %v", chunkIdx, decoded.IsLast, isLast)
@@ -266,13 +266,13 @@ func BenchmarkAudioChunking(b *testing.B) {
 			}
 			chunk := audioBytes[i:end]
 			msg := &messages.TTSAudioChunk{
-				SessionID:   "bench",
-				ChunkIndex:  i / chunkSize,
-				TotalChunks: totalChunks,
+				SessionId:   "bench",
+				ChunkIndex:  int32(i / chunkSize),
+				TotalChunks: int32(totalChunks),
 				Audio:       chunk,
 				SampleRate:  24000,
 			}
-			_, _ = msgpack.Marshal(msg)
+			_, _ = proto.Marshal(msg)
 		}
 	}
 }

go.mod

@@ -3,9 +3,9 @@ module git.daviestechlabs.io/daviestechlabs/tts-module
 go 1.25.1
 
 require (
-	git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3
+	git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0
 	github.com/nats-io/nats.go v1.48.0
-	github.com/vmihailenco/msgpack/v5 v5.4.1
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -19,7 +19,6 @@ require (
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel v1.40.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect
@@ -37,5 +36,4 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/grpc v1.78.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 )

go.sum

@@ -1,5 +1,5 @@
-git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3 h1:uYog8B839ulqrWoht3qqCvT7CnR3e2skpaLZc2Pg3GI=
-git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3/go.mod h1:M3HgvUDWnRn7cX3BE8l+HvoCUYtmRr5OoumB+hnRHoE=
+git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0 h1:pB3ehOKaDYQfbyRBKQXrB9curqSFteLrDveoElRKnBY=
+git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0/go.mod h1:zocOHFt8yY3cW4+Xi37sNr5Tw7KcjGFSZqgWYxPWyqA=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -33,10 +33,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
-github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
-github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
-github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=

main.go

@@ -18,7 +18,7 @@ import (
 	"time"
 
 	"github.com/nats-io/nats.go"
-	"github.com/vmihailenco/msgpack/v5"
+	"google.golang.org/protobuf/proto"
 
 	"git.daviestechlabs.io/daviestechlabs/handler-base/config"
 	"git.daviestechlabs.io/daviestechlabs/handler-base/health"
@@ -128,12 +128,12 @@ func (vr *VoiceRegistry) get(name string) *CustomVoice {
 	return vr.voices[name]
 }
 
-func (vr *VoiceRegistry) listVoices() []messages.TTSVoiceInfo {
+func (vr *VoiceRegistry) listVoices() []*messages.TTSVoiceInfo {
 	vr.mu.RLock()
 	defer vr.mu.RUnlock()
-	result := make([]messages.TTSVoiceInfo, 0, len(vr.voices))
+	result := make([]*messages.TTSVoiceInfo, 0, len(vr.voices))
 	for _, v := range vr.voices {
-		result = append(result, messages.TTSVoiceInfo{
+		result = append(result, &messages.TTSVoiceInfo{
 			Name:      v.Name,
 			Language:  v.Language,
 			ModelType: v.ModelType,
@@ -223,7 +223,7 @@ func main() {
 	// Helper: publish status
 	publishStatus := func(sessionID, status, message string) {
 		statusMsg := &messages.TTSStatus{
-			SessionID: sessionID,
+			SessionId: sessionID,
 			Status:    status,
 			Message:   message,
 			Timestamp: time.Now().Unix(),
@@ -285,13 +285,13 @@ func main() {
 			isLast := end >= len(audioBytes)
 
 			msg := &messages.TTSAudioChunk{
-				SessionID:   sessionID,
-				ChunkIndex:  chunkIndex,
-				TotalChunks: totalChunks,
+				SessionId:   sessionID,
+				ChunkIndex:  int32(chunkIndex),
+				TotalChunks: int32(totalChunks),
 				Audio:       chunk,
 				IsLast:      isLast,
 				Timestamp:   time.Now().Unix(),
-				SampleRate:  sampleRate,
+				SampleRate:  int32(sampleRate),
 			}
 			_ = nc.Publish(fmt.Sprintf("%s.%s", audioSubjectPrefix, sessionID), msg)
 		}
@@ -307,8 +307,8 @@ func main() {
 		}
 		sessionID := parts[4]
 
-		req, err := natsutil.Decode[messages.TTSRequest](natMsg.Data)
-		if err != nil {
+		var req messages.TTSRequest
+		if err := natsutil.Decode(natMsg.Data, &req); err != nil {
 			slog.Error("decode error", "error", err)
 			return
 		}
@@ -343,10 +343,10 @@ func main() {
 			streamAudio(sessionID, audioBytes)
 		} else {
 			msg := &messages.TTSFullResponse{
-				SessionID:  sessionID,
+				SessionId:  sessionID,
 				Audio:      audioBytes,
 				Timestamp:  time.Now().Unix(),
-				SampleRate: sampleRate,
+				SampleRate: int32(sampleRate),
 			}
 			_ = nc.Publish(fmt.Sprintf("%s.%s", audioSubjectPrefix, sessionID), msg)
 		}
@@ -368,7 +368,7 @@ func main() {
 			LastRefresh:    registry.lastRefresh.Unix(),
 			Timestamp:      time.Now().Unix(),
 		}
-		packed, _ := msgpack.Marshal(resp)
+		packed, _ := proto.Marshal(resp)
 		if msg.Reply != "" {
 			_ = msg.Respond(packed)
 		}
@@ -380,11 +380,11 @@ func main() {
 	if _, err := nc.Conn().Subscribe(voicesRefreshSubject, func(msg *nats.Msg) {
 		count := registry.refresh()
 		resp := &messages.TTSVoiceRefreshResponse{
-			Count:        count,
+			Count:        int32(count),
 			CustomVoices: registry.listVoices(),
 			Timestamp:    time.Now().Unix(),
 		}
-		packed, _ := msgpack.Marshal(resp)
+		packed, _ := proto.Marshal(resp)
 		if msg.Reply != "" {
 			_ = msg.Respond(packed)
 		}

main_test.go

@@ -11,7 +11,7 @@ import (
 
 	"git.daviestechlabs.io/daviestechlabs/handler-base/messages"
 	"git.daviestechlabs.io/daviestechlabs/handler-base/natsutil"
-	"github.com/vmihailenco/msgpack/v5"
+	"google.golang.org/protobuf/proto"
 )
 
 func TestVoiceRegistryRefresh(t *testing.T) {
@@ -105,18 +105,18 @@ func TestSynthesizeHTTP(t *testing.T) {
 }
 
 func TestTTSRequestDecode(t *testing.T) {
-	req := messages.TTSRequest{
+	req := &messages.TTSRequest{
 		Text:     "hello world",
 		Speaker:  "custom-en",
 		Language: "en",
 		Stream:   true,
 	}
-	data, err := msgpack.Marshal(&req)
+	data, err := proto.Marshal(req)
 	if err != nil {
 		t.Fatal(err)
 	}
-	decoded, err := natsutil.Decode[messages.TTSRequest](data)
-	if err != nil {
+	var decoded messages.TTSRequest
+	if err := natsutil.Decode(data, &decoded); err != nil {
 		t.Fatal(err)
 	}
 	if decoded.Text != "hello world" {
@@ -132,7 +132,7 @@ func TestTTSRequestDecode(t *testing.T) {
 
 func TestTTSAudioChunkRoundtrip(t *testing.T) {
 	chunk := messages.TTSAudioChunk{
-		SessionID:   "sess-001",
+		SessionId:   "sess-001",
 		ChunkIndex:  0,
 		TotalChunks: 2,
 		Audio:       make([]byte, 32768),
@@ -140,16 +140,16 @@ func TestTTSAudioChunkRoundtrip(t *testing.T) {
 		Timestamp:   1234567890,
 		SampleRate:  24000,
 	}
-	data, err := msgpack.Marshal(&chunk)
+	data, err := proto.Marshal(&chunk)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var got messages.TTSAudioChunk
-	if err := msgpack.Unmarshal(data, &got); err != nil {
+	if err := proto.Unmarshal(data, &got); err != nil {
 		t.Fatal(err)
 	}
-	if got.SessionID != "sess-001" {
-		t.Errorf("SessionID = %q", got.SessionID)
+	if got.SessionId != "sess-001" {
+		t.Errorf("SessionID = %q", got.SessionId)
 	}
 	if len(got.Audio) != 32768 {
 		t.Errorf("Audio len = %d", len(got.Audio))