GKE: mirror base images into this cluster's Harbor over TLS

Same manifest and same script as the homelab repo; what differs is the
registry host and, substantially, TLS.

The homelab's Harbor speaks plain HTTP and its mirror pod passes
--insecure-registry. Harbor here serves a real certificate issued from the
private CA Terraform created, so the pod instead mounts that CA into the
dind container at /etc/docker/certs.d/<registry host>/ca.crt. It goes in
the dind container specifically: dockerd performs the push, while
docker-cli only talks to it over TCP.

The README's project-creation and verification curls now use https and
--cacert, since a laptop has no reason to trust this CA either.

Still no robot credentials in the pod, for the same reason as the
homelab's: the jenkins robot is scoped to the homelab project, and making
base-images public grants anonymous pull but never push. A one-off admin
docker login beats provisioning another robot for something run this
rarely.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

mirror.sh

@@ -1,15 +1,22 @@
 #!/bin/sh
 # Reads images.txt and pulls/retags/pushes each entry into Harbor's
 # base-images project. Meant to run inside a docker-capable container
-# with push credentials already available (docker-cli + dind sidecar,
-# harbor-robot-dockerconfig mounted at /root/.docker/config.json) — same
-# pattern devops-lib's build-tools.Dockerfile bootstrap already uses, see
-# README.md's one-off kubectl pod commands. Not run through any Jenkins
-# pipeline — genuinely one-time/occasional, re-run by hand when
-# images.txt changes.
+# with push credentials already available. On this cluster that means a
+# docker-cli + dind pod where you have run `docker login` as the Harbor
+# admin: the jenkins robot account is scoped to the homelab project and has
+# no grant on base-images, and making base-images public grants anonymous
+# pull, never push.
+#
+# dind must also trust the registry CA (mounted at
+# /etc/docker/certs.d/<registry host>/ca.crt) — Harbor here serves real TLS,
+# unlike the homelab, where the equivalent pod passes --insecure-registry.
+# See README.md for the exact pod manifest.
+#
+# Not run through any Jenkins pipeline — genuinely occasional, re-run by
+# hand when images.txt changes.
 set -eu
 
-REGISTRY="${REGISTRY:-harbor.192.168.1.7.nip.io}"
+REGISTRY="${REGISTRY:-harbor.35.238.248.203.nip.io}"
 PROJECT="${PROJECT:-base-images}"
 
 while read -r src target; do