fix: switch Docker registry to HTTPS endpoint with login-action

- Replace gitea-http.gitea.svc.cluster.local:3000 with registry.lab.daviestechlabs.io
- Use docker/login-action@v3 for Gitea registry auth (proper buildx integration)
- Remove manual base64 auth to ~/.docker/config.json (not picked up by buildkit)
- Remove insecure registry daemon.json config and Docker restart
- Remove buildkitd insecure registry config
- Remove cache-from/cache-to type=gha (not supported on Gitea Actions)

Fixes 401 Unauthorized: reqPackageAccess on Docker push

.gitea/workflows/build-push.yaml

@@ -9,8 +9,8 @@ on:
 env:
   NTFY_URL: http://ntfy.observability.svc.cluster.local:80
   GOPRIVATE: git.daviestechlabs.io
-  REGISTRY: gitea-http.gitea.svc.cluster.local:3000/daviestechlabs
+  REGISTRY: registry.lab.daviestechlabs.io/daviestechlabs
-  REGISTRY_HOST: gitea-http.gitea.svc.cluster.local:3000
+  REGISTRY_HOST: registry.lab.daviestechlabs.io
   IMAGE_NAME: voice-assistant
 
 jobs:
@@ -123,11 +123,13 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+
+      - name: Login to Gitea Registry
+        uses: docker/login-action@v3
         with:
-          buildkitd-config-inline: |
+          registry: ${{ env.REGISTRY_HOST }}
-            [registry."gitea-http.gitea.svc.cluster.local:3000"]
+          username: ${{ secrets.REGISTRY_USER }}
-              http = true
+          password: ${{ secrets.REGISTRY_TOKEN }}
-              insecure = true
 
       - name: Login to Docker Hub
         if: vars.DOCKERHUB_USERNAME != ''
@@ -136,28 +138,6 @@ jobs:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Configure Docker for insecure registry
-        run: |
-          sudo mkdir -p /etc/docker
-          echo '{"insecure-registries": ["${{ env.REGISTRY_HOST }}"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker || sudo service docker restart || true
-          sleep 2
-
-      - name: Login to Gitea Registry
-        run: |
-          AUTH=$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
-          mkdir -p ~/.docker
-          cat > ~/.docker/config.json << EOF
-          {
-            "auths": {
-              "${{ env.REGISTRY_HOST }}": {
-                "auth": "$AUTH"
-              }
-            }
-          }
-          EOF
-          echo "Auth configured for ${{ env.REGISTRY_HOST }}"
-
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
@@ -175,8 +155,7 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
+
-          cache-to: type=gha,mode=max
 
   notify:
     name: Notify

Dockerfile

@@ -3,10 +3,13 @@ FROM golang:1.25-alpine AS builder
 
 WORKDIR /app
 
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates git
+
+ENV GOPRIVATE=git.daviestechlabs.io
+ENV GONOSUMCHECK=git.daviestechlabs.io
 
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=secret,id=netrc,target=/root/.netrc go mod download
 
 COPY . .
 

go.mod

@@ -3,9 +3,9 @@ module git.daviestechlabs.io/daviestechlabs/voice-assistant
 go 1.25.1
 
 require (
-	git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3
+	git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0
 	github.com/nats-io/nats.go v1.48.0
-	github.com/vmihailenco/msgpack/v5 v5.4.1
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -19,7 +19,6 @@ require (
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel v1.40.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect
@@ -37,5 +36,4 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/grpc v1.78.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 )

go.sum

@@ -1,5 +1,5 @@
-git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3 h1:uYog8B839ulqrWoht3qqCvT7CnR3e2skpaLZc2Pg3GI=
+git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0 h1:pB3ehOKaDYQfbyRBKQXrB9curqSFteLrDveoElRKnBY=
-git.daviestechlabs.io/daviestechlabs/handler-base v0.1.3/go.mod h1:M3HgvUDWnRn7cX3BE8l+HvoCUYtmRr5OoumB+hnRHoE=
+git.daviestechlabs.io/daviestechlabs/handler-base v1.0.0/go.mod h1:zocOHFt8yY3cW4+Xi37sNr5Tw7KcjGFSZqgWYxPWyqA=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -33,10 +33,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
-github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
-github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
-github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=

main.go

@@ -16,6 +16,7 @@ import (
 	"git.daviestechlabs.io/daviestechlabs/handler-base/handler"
 	"git.daviestechlabs.io/daviestechlabs/handler-base/messages"
 	"git.daviestechlabs.io/daviestechlabs/handler-base/natsutil"
+	"google.golang.org/protobuf/proto"
 )
 
 func main() {
@@ -43,13 +44,13 @@ func main() {
 
 	h := handler.New("voice.request", cfg)
 
-	h.OnTypedMessage(func(ctx context.Context, msg *nats.Msg) (any, error) {
+	h.OnTypedMessage(func(ctx context.Context, msg *nats.Msg) (proto.Message, error) {
-		req, err := natsutil.Decode[messages.VoiceRequest](msg.Data)
+		var req messages.VoiceRequest
-		if err != nil {
+		if err := natsutil.Decode(msg.Data, &req); err != nil {
 			return &messages.VoiceResponse{Error: "Invalid request encoding"}, nil
 		}
 
-		requestID := req.RequestID
+		requestID := req.RequestId
 		if requestID == "" {
 			requestID = "unknown"
 		}
@@ -64,8 +65,8 @@ func main() {
 
 		slog.Info("processing voice request", "request_id", requestID)
 
-		errResp := func(msg string) (any, error) {
+		errResp := func(msg string) (proto.Message, error) {
-			return &messages.VoiceResponse{RequestID: requestID, Error: msg}, nil
+			return &messages.VoiceResponse{RequestId: requestID, Error: msg}, nil
 		}
 
 		// 1. Audio arrives as raw bytes — no base64 decode needed
@@ -146,7 +147,7 @@ func main() {
 
 		// Build typed response
 		result := &messages.VoiceResponse{
-			RequestID: requestID,
+			RequestId: requestID,
 			Response:  responseText,
 			Audio:     responseAudio,
 		}
@@ -160,13 +161,13 @@ func main() {
 			if len(documents) < limit {
 				limit = len(documents)
 			}
-			result.Sources = make([]messages.DocumentSource, limit)
+			result.Sources = make([]*messages.DocumentSource, limit)
 			for i := 0; i < limit; i++ {
 				text := documents[i].Document
 				if len(text) > 200 {
 					text = text[:200]
 				}
-				result.Sources[i] = messages.DocumentSource{Text: text, Score: documents[i].Score}
+				result.Sources[i] = &messages.DocumentSource{Text: text, Score: documents[i].Score}
 			}
 		}
 

main_test.go

@@ -5,26 +5,26 @@ import (
 
 	"git.daviestechlabs.io/daviestechlabs/handler-base/messages"
 	"git.daviestechlabs.io/daviestechlabs/handler-base/natsutil"
-	"github.com/vmihailenco/msgpack/v5"
+	"google.golang.org/protobuf/proto"
 )
 
 func TestVoiceRequestDecode(t *testing.T) {
-	req := messages.VoiceRequest{
+	req := &messages.VoiceRequest{
-		RequestID:  "req-123",
+		RequestId:  "req-123",
 		Audio:      []byte{0x01, 0x02, 0x03},
 		Language:   "en",
 		Collection: "docs",
 	}
-	data, err := msgpack.Marshal(&req)
+	data, err := proto.Marshal(req)
 	if err != nil {
 		t.Fatal(err)
 	}
-	decoded, err := natsutil.Decode[messages.VoiceRequest](data)
+	var decoded messages.VoiceRequest
-	if err != nil {
+	if err := natsutil.Decode(data, &decoded); err != nil {
 		t.Fatal(err)
 	}
-	if decoded.RequestID != "req-123" {
+	if decoded.RequestId != "req-123" {
-		t.Errorf("RequestID = %q", decoded.RequestID)
+		t.Errorf("RequestId = %q", decoded.RequestId)
 	}
 	if len(decoded.Audio) != 3 {
 		t.Errorf("Audio len = %d", len(decoded.Audio))
@@ -32,19 +32,19 @@ func TestVoiceRequestDecode(t *testing.T) {
 }
 
 func TestVoiceResponseRoundtrip(t *testing.T) {
-	resp := messages.VoiceResponse{
+	resp := &messages.VoiceResponse{
-		RequestID:     "req-456",
+		RequestId:     "req-456",
 		Response:      "It is sunny today.",
 		Audio:         make([]byte, 8000),
 		Transcription: "What is the weather?",
-		Sources:       []messages.DocumentSource{{Text: "weather doc", Score: 0.9}},
+		Sources:       []*messages.DocumentSource{{Text: "weather doc", Score: 0.9}},
 	}
-	data, err := msgpack.Marshal(&resp)
+	data, err := proto.Marshal(resp)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var got messages.VoiceResponse
-	if err := msgpack.Unmarshal(data, &got); err != nil {
+	if err := proto.Unmarshal(data, &got); err != nil {
 		t.Fatal(err)
 	}
 	if got.Response != "It is sunny today." {