fix: mark secrets-changed deploy as internal to use localhost registry

The debounced deploy from SecretsChangedHandler called Deploy without
WithInternalDeploy context, causing image pulls to hit the external
registry (connection refused) instead of localhost:5000. All other
server-side handlers already used this wrapper.

Closes #111

commit: 103b7275f99fdd06f341ea842571898f234c23ff
author: brice · 7mo ago · 2026-03-14 21:14 UTC
parent: 989f93f
signature: unsigned

1 file · +1 -1

M internal/usecase/container/secrets_handler.go +1 -1


@@ -149,7 +149,7 @@ func (h *SecretsChangedHandler) fireDeploy(ctx context.Context, domainName strin
149	149
150	150		log.Info().Str("image", route.Image).Msg("debounce fired, deploying after secrets change")
151	151
152		-	if _, err := h.containerSvc.Deploy(ctx, *route); err != nil {
	152	+	if _, err := h.containerSvc.Deploy(domain.WithInternalDeploy(ctx), *route); err != nil {
153	153		log.WrapErr(err, "secrets-changed deploy failed")
154	154		}
155	155		}


@@ -149,7 +149,7 @@ func (h *SecretsChangedHandler) fireDeploy(ctx context.Context, domainName strin
149			149
150		log.Info().Str("image", route.Image).Msg("debounce fired, deploying after secrets change")	150		log.Info().Str("image", route.Image).Msg("debounce fired, deploying after secrets change")
151			151
152	-	if _, err := h.containerSvc.Deploy(ctx, *route); err != nil {	152	+	if _, err := h.containerSvc.Deploy(domain.WithInternalDeploy(ctx), *route); err != nil {
153		log.WrapErr(err, "secrets-changed deploy failed")	153		log.WrapErr(err, "secrets-changed deploy failed")
154		}	154		}
155		}	155		}