From 91532a3805a16e76a9cc2516f14d902e4a177791 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Fri, 28 Aug 2026 07:05:24 -0700
Subject: [PATCH] anubis: repin the image ref to the lowercase ghcr path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

podman's reference parser rejects mixed-case repository refs before any
network I/O ('repository name must be uppercase'); upstream's own install
docs pull lowercase (ghcr resolves case-insensitively). The first deploy
of this chain exit-2'd on that parse error — the image was not yet
pulled, so the guarded vhosts 502 until this deploy lands.
---
 dankclaw/anubis/quadlet/anubis.container | 4 ++--
 scripts/deploy-remote.sh                 | 4 ++--
 tests/anubis.bats                        | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dankclaw/anubis/quadlet/anubis.container b/dankclaw/anubis/quadlet/anubis.container
index 32afc7f..c5afd9d 100644
--- a/dankclaw/anubis/quadlet/anubis.container
+++ b/dankclaw/anubis/quadlet/anubis.container
@@ -11,7 +11,7 @@
 # per-vhost routing — including Authentik forward_auth — resumes. Host headers
 # survive both hops, so vhost matching on the internal listener still works.
 #
-# Version pin: ghcr.io/TecharoHQ/anubis:v1.13.0 was source-verified before
+# Version pin: ghcr.io/techaroq/anubis:v1.13.0 was source-verified before
 # pinning (policy parser is JSON-only at this tag, flags are the config
 # surface via flagenv: an env var named TARGET sets --target, POLICY_FNAME
 # sets --policy-fname). Upgrading = stop unit, change Image=, deploy; policy
@@ -28,7 +28,7 @@ Wants=network-online.target
 
 [Container]
 ContainerName=anubis
-Image=ghcr.io/TecharoHQ/anubis:v1.13.0
+Image=ghcr.io/techaroq/anubis:v1.13.0
 Pull=never
 Network=dankclaw_default
 # flagenv maps env names to flag names (TARGET -> --target, POLICY_FNAME ->
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 19de30e..e897f4c 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -554,8 +554,8 @@ deploy_anubis() {
     # Anubis is the bot-challenge proxy in front of the guarded vhosts.
     # The image lives on ghcr.io; pull once, then the unit runs it from
     # local storage (Pull=never keeps boots off the registry).
-    if ! podman image inspect ghcr.io/TecharoHQ/anubis:v1.13.0 >/dev/null 2>&1; then
-        podman pull ghcr.io/TecharoHQ/anubis:v1.13.0
+    if ! podman image inspect ghcr.io/techaroq/anubis:v1.13.0 >/dev/null 2>&1; then
+        podman pull ghcr.io/techaroq/anubis:v1.13.0
     fi
     cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
diff --git a/tests/anubis.bats b/tests/anubis.bats
index eb187be..d9367c7 100755
--- a/tests/anubis.bats
+++ b/tests/anubis.bats
@@ -23,7 +23,7 @@ setup() {
 }
 
 @test "the image is pinned to an exact upstream tag and never pulled at boot" {
-    grep -qE '^Image=ghcr\.io/TecharoHQ/anubis:v[0-9]+\.[0-9]+\.[0-9]+$' "$UNIT"
+    grep -qE '^Image=ghcr\.io/techaroq/anubis:v[0-9]+\.[0-9]+\.[0-9]+$' "$UNIT"
     grep -q '^Pull=never$' "$UNIT"
 }