Bump every template's VERSION to publish the git.octoturge.com fix

The host-gateway change in the previous commit only takes effect on a new
template version - bump every template's VERSION file from 1 to 2 so
coder-templates.yml actually pushes it instead of skipping as "already
pushed". Existing workspaces need a stop/start against the new version to
pick up the updated docker_container host mapping.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YRq8ts9zwge8Rttbuku9FQ

.gitea/workflows/coder-templates.yml

@@ -2,23 +2,38 @@ name: Provision Coder Templates
 
 # Keeps Coder templates in sync with templates/*/ in this repo:
 #   - every push to main pushes a new version of each templates/<env>/ dir
-#     (coder templates push creates it if it doesn't exist yet, so adding a
-#     new templates/<env>/ directory is enough to provision a new one)
+#     whose VERSION file names a version not already pushed (coder templates
+#     push creates the template if it doesn't exist yet, so adding a new
+#     templates/<env>/ directory - with a VERSION file - is enough to
+#     provision a new one). This workflow triggers on any change under
+#     templates/**, not just a specific template's own directory, so VERSION
+#     is what keeps an edit to one template from generating a no-op new
+#     version for every other, unchanged template.
 #   - if a templates/<env>/ directory is removed on main, its template is
 #     deleted from Coder. `coder templates delete` refuses to delete a
 #     template that still has active workspaces, so this can't silently
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
-# Requires two repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL             e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+# Requires three repo/org secrets (Settings > Actions > Secrets):
+#   CODER_URL              e.g. https://code.octoturge.com
+#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing each
+#                          Dockerfile-having template's image to this
+#                          instance's container registry.
 #
-# Pushing each Dockerfile-having template's image to this instance's
-# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
-# manually-created PAT needed) - build-images grants it write access via
-# `permissions: packages: write` below. See
-# https://docs.gitea.com/usage/actions/token-permissions/
+# Not secrets.GITEA_TOKEN (Gitea Actions' built-in token): as of this
+# writing it cannot authenticate to the container registry in any shipped
+# Gitea version - `permissions: packages: write` is a no-op because the
+# Actions token's package scope isn't wired up server-side yet (open since
+# Gitea 1.19: https://github.com/go-gitea/gitea/issues/23642; fix in
+# https://github.com/go-gitea/gitea/pull/39070, not yet merged). Every
+# attempt fails at docker login with a plain "unauthorized", regardless of
+# the permissions: block or which account triggered the workflow. A
+# manually-created PAT is the only thing that currently works. Named
+# without a GITEA_ prefix because Gitea Actions reserves that prefix for
+# its own built-in secrets and rejects creating one with that name.
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -49,9 +64,10 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
-    # The default token permission mode denies package write unless a job
-    # explicitly asks for it - without this, docker push fails with
-    # "unauthorized: reqPackageAccess".
+    # Currently a no-op (see the PACKAGE_REGISTRY_TOKEN note above) but
+    # harmless to declare now - once go-gitea/gitea#39070 ships, GITEA_TOKEN
+    # will need this to get package write access, so this is one less thing
+    # to remember when PACKAGE_REGISTRY_TOKEN can eventually be retired.
     permissions:
       packages: write
     outputs:
@@ -79,7 +95,7 @@ jobs:
         id: build
         run: |
           set -e
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
+          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do
@@ -143,9 +159,42 @@ jobs:
                 continue
                 ;;
             esac
+
+            # templates/<name>/VERSION lets a template opt out of being
+            # reprovisioned on every push: bump it and coder templates push
+            # names the new version "v<N>". This is a manual contract, not a
+            # content hash - editing a template without bumping its VERSION
+            # means the change won't go out until someone does. paths: on
+            # this workflow's trigger is templates/** as a whole, so without
+            # this every template gets a new (identical) version on any push
+            # under templates/, even ones whose own directory didn't change.
+            #
+            # Rather than pre-checking `coder templates versions list` for
+            # whether v<N> already exists (fragile - depends on its exact
+            # JSON shape matching what we expect), just attempt the push and
+            # treat its specific "version already exists" failure as the
+            # skip signal instead.
+            version=""
+            if [ -f "$dir/VERSION" ]; then
+              version="$(tr -d '[:space:]' < "$dir/VERSION")"
+            fi
+
+            args=(-d "$dir" --yes -m "auto-provisioned from ${GITHUB_SHA:0:12}")
+            [ -n "$version" ] && args+=(--name "v$version")
+
             echo "::group::Pushing $full from $dir"
-            coder templates push "$full" -d "$dir" --yes \
-              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
+            if push_output="$(coder templates push "$full" "${args[@]}" 2>&1)"; then
+              echo "$push_output"
+            else
+              push_status=$?
+              echo "$push_output"
+              if [ -n "$version" ] && printf '%s' "$push_output" | grep -qF "A template version with name \"v$version\" already exists"; then
+                echo "Version v$version (templates/$name/VERSION) is already pushed - nothing to do. Bump the VERSION file to push a new one."
+              else
+                echo "::endgroup::"
+                exit "$push_status"
+              fi
+            fi
             echo "::endgroup::"
           done
 

templates/3d-printing/VERSION

@@ -0,0 +1 @@
+2

templates/3d-printing/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/cobol/VERSION

@@ -0,0 +1 @@
+2

templates/cobol/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/default/VERSION

@@ -0,0 +1 @@
+2

templates/default/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/python/VERSION

@@ -0,0 +1 @@
+2

templates/python/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/ttrpg/VERSION

@@ -0,0 +1 @@
+2

templates/ttrpg/main.tf

@@ -204,6 +204,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name

templates/web/Dockerfile

@@ -11,7 +11,8 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         locales sudo ca-certificates gnupg curl wget \
     && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \
@@ -28,30 +29,69 @@ RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
     && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
         > /etc/apt/sources.list.d/google-chrome.list \
     && apt-get update && apt-get install -y google-chrome-stable \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
+#
+# Split into several RUN steps (rather than one big apt-get install) so no
+# single resulting layer is too large to push to the registry - it sits
+# behind a reverse proxy with a request body size cap, and a couple of these
+# packages (llvm, libopencv-dev, libwebkit2gtk-4.1-dev) are individually
+# large enough to blow past it if lumped together with everything else.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential pkg-config cmake \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        clang llvm \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        build-essential pkg-config cmake clang llvm \
         git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
+    && git lfs install --system \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libssl-dev libpq-dev libsqlite3-dev \
+        postgresql-client redis-tools sqlite3 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
         libgtk-3-dev libsoup-3.0-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
-        postgresql-client redis-tools sqlite3 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
         python3 python3-pip python3-venv python3-dev \
-        libopencv-dev \
         protobuf-compiler \
-    && git lfs install --system \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopencv-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
 # system PATH for every user.
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g pnpm yarn \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
+
+RUN npm install -g pnpm yarn
 
 # Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
 # Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
@@ -61,9 +101,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
 # fails trying to uninstall it in place - and it's unneeded anyway, the
 # packages below install fine under the stock version.
+#
+# Each package gets its own RUN/layer for the same reverse-proxy body-size
+# reason as the apt-get split above - torch's CPU wheel and opencv-python's
+# wheel are each large enough on their own to be worth isolating.
+RUN python3 -m pip install --break-system-packages --no-cache-dir numpy
+RUN python3 -m pip install --break-system-packages --no-cache-dir opencv-python-headless
+RUN python3 -m pip install --break-system-packages --no-cache-dir onnxruntime
 RUN python3 -m pip install --break-system-packages --no-cache-dir \
-        numpy opencv-python-headless onnxruntime \
-    && python3 -m pip install --break-system-packages --no-cache-dir \
         torch --index-url https://download.pytorch.org/whl/cpu
 
 # Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
@@ -88,15 +133,32 @@ WORKDIR /home/coder
 
 # Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
 # native + musl targets for x86_64/aarch64, and cargo helper utilities.
+#
+# Split into one RUN per target/tool (rather than one big chained command) so
+# no single layer is too large to push to the registry, for the same
+# reverse-proxy body-size reason as the apt-get split above - the base
+# toolchain and each additional target's std library are each sizeable, and
+# `cargo install` leaves a build/registry cache behind that needs clearing
+# inside its own RUN, or it would just bloat that same layer instead.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
         --default-toolchain stable --profile default \
-    && rustup component add rustfmt clippy rust-analyzer rust-src \
-    && rustup target add \
-        x86_64-unknown-linux-gnu \
-        x86_64-unknown-linux-musl \
-        aarch64-unknown-linux-gnu \
-        aarch64-unknown-linux-musl \
-    && cargo install --locked cargo-watch cargo-edit cross bacon
+    && rm -rf "$RUSTUP_HOME"/tmp "$RUSTUP_HOME"/downloads
+
+RUN rustup component add rustfmt clippy rust-analyzer rust-src
+
+RUN rustup target add x86_64-unknown-linux-gnu
+RUN rustup target add x86_64-unknown-linux-musl
+RUN rustup target add aarch64-unknown-linux-gnu
+RUN rustup target add aarch64-unknown-linux-musl
+
+RUN cargo install --locked cargo-watch \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked cargo-edit \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked cross \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
+RUN cargo install --locked bacon \
+    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 
 # Bun: global runtime for the ElysiaJS backend and fast scripting.
 RUN curl -fsSL https://bun.sh/install | bash

templates/web/VERSION

@@ -0,0 +1 @@
+2

templates/web/main.tf

@@ -226,6 +226,13 @@ resource "docker_container" "workspace" {
     host = "code.octoturge.com"
     ip   = "host-gateway"
   }
+  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
+  # without this the workspace's public DNS answer for git.octoturge.com
+  # NAT-hairpins back to the LAN and times out (curl: (28)).
+  host {
+    host = "git.octoturge.com"
+    ip   = "host-gateway"
+  }
   volumes {
     container_path = "/home/coder"
     volume_name    = docker_volume.home_volume.name