#!/bin/sh
# Reads images.txt and pulls/retags/pushes each entry into Harbor's
# base-images project. Meant to run inside a docker-capable container
# with push credentials already available. On this cluster that means a
# docker-cli + dind pod where you have run `docker login` as the Harbor
# admin: the jenkins robot account is scoped to the homelab project and has
# no grant on base-images, and making base-images public grants anonymous
# pull, never push.
#
# dind must also trust the registry CA (mounted at
# /etc/docker/certs.d/<registry host>/ca.crt) — Harbor here serves real TLS,
# unlike the homelab, where the equivalent pod passes --insecure-registry.
# See README.md for the exact pod manifest.
#
# Not run through any Jenkins pipeline — genuinely occasional, re-run by
# hand when images.txt changes.
set -eu

REGISTRY="${REGISTRY:-harbor.35.238.248.203.nip.io}"
PROJECT="${PROJECT:-base-images}"

while read -r src target; do
    [ -z "$src" ] && continue
    case "$src" in \#*) continue ;; esac

    dest="${REGISTRY}/${PROJECT}/${target}"
    echo "=== ${src} -> ${dest} ==="
    docker pull "$src"
    docker tag "$src" "$dest"
    docker push "$dest"
done < images.txt

echo "=== done ==="