web: build image in CI, pull it in Terraform instead of building locally

templates/web's docker_image resource used a `build` block, so every first-use of a new Dockerfile hash triggered a from-scratch build (including the ~15-20min Rust toolchain compile) right at `terraform apply` time - i.e. while someone was waiting to create a workspace. Adds a build-web-image job to coder-templates.yml that builds and pushes git.octoturge.com/octo-tech/profiles-web:<dockerfile-sha1> to this instance's container registry, tagged identically to what docker_image.web now computes and pulls (no build block). provision now depends on build-web-image so a template never gets pushed pointing at an image that isn't there yet. Skips the build entirely if that tag's already in the registry, so an unrelated templates/* change doesn't pay any cost. Runs on a new dedicated "docker-build" runner (profiles-web-build), scoped to just this repo via a repo-level registration token, with host Docker socket access - deliberately not added to the existing shared runner-1, which has no such access and stays untouched. Repo is public, so the pulled image needs no registry auth; the push does, via a new GITEA_PACKAGE_TOKEN repo secret (write:package scope). Since CI and this Coder deployment share the same Docker daemon, the "pull" is normally a same-host cache hit, not a real network pull. Verified: `terraform validate` passes against the updated templates/web/main.tf (run directly inside the coder-server container, which has terraform embedded).
cli-setup-wizard: stop parsing tea's config.yml, use tea itself
2026-08-27 01:10:58 +02:00 · 2026-08-27 00:49:20 +02:00 · 2026-08-27 00:14:11 +02:00
8 changed files with 137 additions and 105 deletions
@@ -13,6 +13,19 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing templates/web's
+#                          image to this instance's container registry. Only
+#                          the octoturge account's own token is used - login()
+#                          hardcodes that username to match.
+#
+# templates/web builds its Docker image here (build-web-image, on the
+# dedicated "docker-build" runner - see templates/web/main.tf for why: that
+# runner is scoped to this repo only and has host Docker socket access that
+# the shared runner-1 deliberately doesn't). provision then just pulls the
+# tag build-web-image produced, instead of building it itself at
+# `terraform apply` time - keeps the slow Rust toolchain compile off of
+# "someone is waiting to create a workspace".

 on:
  push:
@@ -23,7 +36,30 @@ on:
  workflow_dispatch: {}

 jobs:
+  build-web-image:
+    runs-on: docker-build
+    container:
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build and push templates/web's image (skips if the tag already exists)
+        run: |
+          set -e
+          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
+          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
+          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
+            echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
+            exit 0
+          fi
+          docker build -t "$IMAGE" templates/web
+          docker push "$IMAGE"
+
  provision:
+    needs: build-web-image
    runs-on: ubuntu-latest
    env:
      CODER_URL: ${{ secrets.CODER_URL }}
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -143,12 +143,11 @@ else
    fi
  fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1

 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
    fi

    if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi

@@ -226,17 +222,20 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
      fi

      if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi

 echo ""
@@ -193,16 +193,18 @@ resource "docker_volume" "home_volume" {
  }
 }

-# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
-# directory, so no external registry push is required. The tag embeds the
-# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
-# while an unchanged Dockerfile reuses the cached image.
+# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
+# The image is built and pushed by .gitea/workflows/coder-templates.yml's
+# build-web-image job, tagged with the same Dockerfile hash this resource
+# computes - so a Dockerfile edit always resolves to the matching image, and
+# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
+# it, and this pull is normally a same-host cache hit rather than a real
+# network pull, since CI and this Coder deployment share one Docker daemon).
+# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
+# create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
-  build {
-    context = path.module
-  }
+  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
  keep_locally = true
 }