cli-setup-wizard: stop parsing tea's config.yml, use tea itself

DID_GITEA detection and the SSH/GPG key uploads to Gitea were reading
tea's config.yml directly with awk, assuming 2-space indentation and a
plaintext `token:` field. Neither holds: the real format uses 6-space
indentation for fields under each login, and a login done via OAuth
(tea's default flow) has no token field in the file at all - it's held
elsewhere. Confirmed live: a workspace with a genuinely active `tea`
OAuth login was still reporting "not logged in" and skipping the whole
key-setup step because of this.

Replaced with tea's own subcommands, which handle auth internally
regardless of method:
  - detection: `tea whoami`
  - SSH key upload: `tea ssh-keys add`
  - GPG key upload: `tea api -X POST /user/gpg_keys -F armored_public_key=@-`

Verified all three directly against the live account (disposable test
SSH + GPG keys, added then removed) - SSH upload succeeded; the GPG
upload correctly failed for an unrelated, expected reason (Gitea
requires the key's email to match a verified account email, and the
test key used a throwaway address), confirming the request itself is
well-formed.

.gitea/workflows/coder-templates.yml

@@ -13,19 +13,6 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
-#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
-#                          with write:package scope, for pushing templates/web's
-#                          image to this instance's container registry. Only
-#                          the octoturge account's own token is used - login()
-#                          hardcodes that username to match.
-#
-# templates/web builds its Docker image here (build-web-image, on the
-# dedicated "docker-build" runner - see templates/web/main.tf for why: that
-# runner is scoped to this repo only and has host Docker socket access that
-# the shared runner-1 deliberately doesn't). provision then just pulls the
-# tag build-web-image produced, instead of building it itself at
-# `terraform apply` time - keeps the slow Rust toolchain compile off of
-# "someone is waiting to create a workspace".
 
 on:
   push:
@@ -36,30 +23,7 @@ on:
   workflow_dispatch: {}
 
 jobs:
-  build-web-image:
-    runs-on: docker-build
-    container:
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Build and push templates/web's image (skips if the tag already exists)
-        run: |
-          set -e
-          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
-          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
-          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
-          if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
-            echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
-            exit 0
-          fi
-          docker build -t "$IMAGE" templates/web
-          docker push "$IMAGE"
-
   provision:
-    needs: build-web-image
     runs-on: ubuntu-latest
     env:
       CODER_URL: ${{ secrets.CODER_URL }}

templates/3d-printing/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/cobol/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/default/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/python/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/ttrpg/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/web/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
+# `tea whoami` succeeds regardless of how the login was done (personal
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
+# access token or OAuth) - more reliable than parsing tea's own
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
+# config.yml, whose indentation and fields (no plaintext `token:` at all
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
+# for an OAuth login) vary by auth method.
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
-fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/web/main.tf

@@ -193,18 +193,16 @@ resource "docker_volume" "home_volume" {
   }
 }
 
-# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
+# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
-# The image is built and pushed by .gitea/workflows/coder-templates.yml's
+# directory, so no external registry push is required. The tag embeds the
-# build-web-image job, tagged with the same Dockerfile hash this resource
+# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
-# computes - so a Dockerfile edit always resolves to the matching image, and
+# while an unchanged Dockerfile reuses the cached image.
-# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
-# it, and this pull is normally a same-host cache hit rather than a real
-# network pull, since CI and this Coder deployment share one Docker daemon).
-# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
-# create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
+  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
+  build {
+    context = path.module
+  }
   keep_locally = true
 }