From 25def5ce0722521c738dbd0486cd3997638df03c Mon Sep 17 00:00:00 2001
From: LovroG05 <lovro@govekar.net>
Date: Mon, 29 Jun 2026 18:31:35 +0200
Subject: [PATCH] fix: remove --tls insecure; requires Gitea ROOT_URL set to
 HTTPS

---
 .gitea/workflows/docker.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 10f3cf3..1052a46 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -78,16 +78,15 @@ jobs:
             -o /usr/local/bin/regctl
           chmod +x /usr/local/bin/regctl
 
-      # Configure regctl with basic auth and tls=insecure to avoid the ping that
-      # follows the HTTPS→HTTP redirect Gitea advertises for its token endpoint.
+      # Configure regctl with basic auth. Requires Gitea ROOT_URL to be set to
+      # the HTTPS URL so its token endpoint is advertised as https://, not http://.
       - name: Configure registry auth
         if: github.event_name != 'pull_request'
         run: |
           regctl registry set ${{ env.REGISTRY }} \
             -u ${{ secrets.REGISTRY_USER }} \
             -p ${{ secrets.REGISTRY_PASSWORD }} \
-            --auth-basic \
-            --tls insecure
+            --auth-basic
 
       - name: Push standard image
         if: github.event_name != 'pull_request'