Add a git credential helper for Gitea, backed by tea's own login

Coder's GIT_ASKPASS only knows about github.com; for git.octoturge.com
it falls through to a broken interactive prompt, so `git push`/`pull`
over HTTPS hangs or fails even after `tea login add` succeeds. A
credential helper answering `git credential fill` runs before
GIT_ASKPASS is consulted, so wire one up (gated on the wizard's
existing DID_GITEA check) that reads the live OAuth token straight out
of tea's own credentials.json - verified end-to-end against a running
workspace (git ls-remote over HTTPS authenticated successfully).

Bump every template's VERSION to publish it.

.gitea/workflows/coder-templates.yml

@@ -2,23 +2,38 @@ name: Provision Coder Templates
 
 # Keeps Coder templates in sync with templates/*/ in this repo:
 #   - every push to main pushes a new version of each templates/<env>/ dir
-#     (coder templates push creates it if it doesn't exist yet, so adding a
+#     whose VERSION file names a version not already pushed (coder templates
-#     new templates/<env>/ directory is enough to provision a new one)
+#     push creates the template if it doesn't exist yet, so adding a new
+#     templates/<env>/ directory - with a VERSION file - is enough to
+#     provision a new one). This workflow triggers on any change under
+#     templates/**, not just a specific template's own directory, so VERSION
+#     is what keeps an edit to one template from generating a no-op new
+#     version for every other, unchanged template.
 #   - if a templates/<env>/ directory is removed on main, its template is
 #     deleted from Coder. `coder templates delete` refuses to delete a
 #     template that still has active workspaces, so this can't silently
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
-# Requires two repo/org secrets (Settings > Actions > Secrets):
+# Requires three repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL             e.g. https://code.octoturge.com
+#   CODER_URL              e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing each
+#                          Dockerfile-having template's image to this
+#                          instance's container registry.
 #
-# Pushing each Dockerfile-having template's image to this instance's
+# Not secrets.GITEA_TOKEN (Gitea Actions' built-in token): as of this
-# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
+# writing it cannot authenticate to the container registry in any shipped
-# manually-created PAT needed) - build-images grants it write access via
+# Gitea version - `permissions: packages: write` is a no-op because the
-# `permissions: packages: write` below. See
+# Actions token's package scope isn't wired up server-side yet (open since
-# https://docs.gitea.com/usage/actions/token-permissions/
+# Gitea 1.19: https://github.com/go-gitea/gitea/issues/23642; fix in
+# https://github.com/go-gitea/gitea/pull/39070, not yet merged). Every
+# attempt fails at docker login with a plain "unauthorized", regardless of
+# the permissions: block or which account triggered the workflow. A
+# manually-created PAT is the only thing that currently works. Named
+# without a GITEA_ prefix because Gitea Actions reserves that prefix for
+# its own built-in secrets and rejects creating one with that name.
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -49,9 +64,10 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
-    # The default token permission mode denies package write unless a job
+    # Currently a no-op (see the PACKAGE_REGISTRY_TOKEN note above) but
-    # explicitly asks for it - without this, docker push fails with
+    # harmless to declare now - once go-gitea/gitea#39070 ships, GITEA_TOKEN
-    # "unauthorized: reqPackageAccess".
+    # will need this to get package write access, so this is one less thing
+    # to remember when PACKAGE_REGISTRY_TOKEN can eventually be retired.
     permissions:
       packages: write
     outputs:
@@ -79,7 +95,7 @@ jobs:
         id: build
         run: |
           set -e
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
+          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do
@@ -143,9 +159,42 @@ jobs:
                 continue
                 ;;
             esac
+
+            # templates/<name>/VERSION lets a template opt out of being
+            # reprovisioned on every push: bump it and coder templates push
+            # names the new version "v<N>". This is a manual contract, not a
+            # content hash - editing a template without bumping its VERSION
+            # means the change won't go out until someone does. paths: on
+            # this workflow's trigger is templates/** as a whole, so without
+            # this every template gets a new (identical) version on any push
+            # under templates/, even ones whose own directory didn't change.
+            #
+            # Rather than pre-checking `coder templates versions list` for
+            # whether v<N> already exists (fragile - depends on its exact
+            # JSON shape matching what we expect), just attempt the push and
+            # treat its specific "version already exists" failure as the
+            # skip signal instead.
+            version=""
+            if [ -f "$dir/VERSION" ]; then
+              version="$(tr -d '[:space:]' < "$dir/VERSION")"
+            fi
+
+            args=(-d "$dir" --yes -m "auto-provisioned from ${GITHUB_SHA:0:12}")
+            [ -n "$version" ] && args+=(--name "v$version")
+
             echo "::group::Pushing $full from $dir"
-            coder templates push "$full" -d "$dir" --yes \
+            if push_output="$(coder templates push "$full" "${args[@]}" 2>&1)"; then
-              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
+              echo "$push_output"
+            else
+              push_status=$?
+              echo "$push_output"
+              if [ -n "$version" ] && printf '%s' "$push_output" | grep -qF "A template version with name \"v$version\" already exists"; then
+                echo "Version v$version (templates/$name/VERSION) is already pushed - nothing to do. Bump the VERSION file to push a new one."
+              else
+                echo "::endgroup::"
+                exit "$push_status"
+              fi
+            fi
             echo "::endgroup::"
           done
 

templates/3d-printing/VERSION

@@ -0,0 +1 @@
+3

templates/3d-printing/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/3d-printing/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/cobol/VERSION

@@ -0,0 +1 @@
+3

templates/cobol/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/cobol/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/default/VERSION

@@ -0,0 +1 @@
+3

templates/default/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/default/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/python/VERSION

@@ -0,0 +1 @@
+3

templates/python/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/python/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/ttrpg/VERSION

@@ -0,0 +1 @@
+3

templates/ttrpg/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/ttrpg/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/web/Dockerfile

@@ -11,7 +11,8 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         locales sudo ca-certificates gnupg curl wget \
     && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \
@@ -28,30 +29,69 @@ RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
     && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
         > /etc/apt/sources.list.d/google-chrome.list \
     && apt-get update && apt-get install -y google-chrome-stable \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
+#
+# Split into several RUN steps (rather than one big apt-get install) so no
+# single resulting layer is too large to push to the registry - it sits
+# behind a reverse proxy with a request body size cap, and a couple of these
+# packages (llvm, libopencv-dev, libwebkit2gtk-4.1-dev) are individually
+# large enough to blow past it if lumped together with everything else.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential pkg-config cmake \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        clang llvm \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        build-essential pkg-config cmake clang llvm \
         git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
+    && git lfs install --system \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libssl-dev libpq-dev libsqlite3-dev \
+        postgresql-client redis-tools sqlite3 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
         libgtk-3-dev libsoup-3.0-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
-        postgresql-client redis-tools sqlite3 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         python3 python3-pip python3-venv python3-dev \
-        libopencv-dev \
         protobuf-compiler \
-    && git lfs install --system \
+    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopencv-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
 # system PATH for every user.
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g pnpm yarn \
+    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN npm install -g pnpm yarn
 
 # Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
 # Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
@@ -61,9 +101,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
 # fails trying to uninstall it in place - and it's unneeded anyway, the
 # packages below install fine under the stock version.
+#
+# Each package gets its own RUN/layer for the same reverse-proxy body-size
+# reason as the apt-get split above - torch's CPU wheel and opencv-python's
+# wheel are each large enough on their own to be worth isolating.
+RUN python3 -m pip install --break-system-packages --no-cache-dir numpy
+RUN python3 -m pip install --break-system-packages --no-cache-dir opencv-python-headless
+RUN python3 -m pip install --break-system-packages --no-cache-dir onnxruntime
 RUN python3 -m pip install --break-system-packages --no-cache-dir \
-        numpy opencv-python-headless onnxruntime \
-    && python3 -m pip install --break-system-packages --no-cache-dir \
         torch --index-url https://download.pytorch.org/whl/cpu
 
 # Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
@@ -88,15 +133,32 @@ WORKDIR /home/coder
 
 # Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
 # native + musl targets for x86_64/aarch64, and cargo helper utilities.
+#
+# Split into one RUN per target/tool (rather than one big chained command) so
+# no single layer is too large to push to the registry, for the same
+# reverse-proxy body-size reason as the apt-get split above - the base
+# toolchain and each additional target's std library are each sizeable, and
+# `cargo install` leaves a build/registry cache behind that needs clearing
+# inside its own RUN, or it would just bloat that same layer instead.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
         --default-toolchain stable --profile default \
-    && rustup component add rustfmt clippy rust-analyzer rust-src \
+    && rm -rf "$RUSTUP_HOME"/tmp "$RUSTUP_HOME"/downloads
-    && rustup target add \
+
-        x86_64-unknown-linux-gnu \
+RUN rustup component add rustfmt clippy rust-analyzer rust-src
-        x86_64-unknown-linux-musl \
+
-        aarch64-unknown-linux-gnu \
+RUN rustup target add x86_64-unknown-linux-gnu
-        aarch64-unknown-linux-musl \
+RUN rustup target add x86_64-unknown-linux-musl
-    && cargo install --locked cargo-watch cargo-edit cross bacon
+RUN rustup target add aarch64-unknown-linux-gnu
+RUN rustup target add aarch64-unknown-linux-musl
+
+RUN cargo install --locked cargo-watch \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked cargo-edit \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked cross \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked bacon \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 
 # Bun: global runtime for the ElysiaJS backend and fast scripting.
 RUN curl -fsSL https://bun.sh/install | bash

templates/web/VERSION

@@ -0,0 +1 @@
+3

templates/web/cli-setup-wizard.sh

@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).

templates/web/main.tf

@@ -226,6 +226,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name