fix(docker): point MinIO at quay.io — the Docker Hub repository is gone

[acamarata]

Main is red

Accessibility E2E Tests (Playwright + Axe) fails at Start nself backend stack (run 34837167497):

minio Error pull access denied for minio/minio, repository does not exist
or may require 'docker login': denied: requested access to the resource is denied
##[error]Process completed with exit code 1

MinIO removed minio/minio from Docker Hub:

check	result
hub.docker.com/v2/repositories/minio/minio/	{"message":"object not found"}
manifest minio/minio:latest, anonymous	401
manifest minio/minio:latest, authenticated	401
quay.io/minio/minio:latest, anonymous	200

I tested with valid Docker Hub credentials before assuming: authenticating does not help. The repository is gone, not rate-limited, so adding docker/login-action would have been the wrong fix. quay.io/minio/minio is MinIO's own registry.

Verification

Resolved the CI stack exactly as the workflow does (.env.dev + the CI computed vars) and checked every image:

ok  axllent/mailpit:latest      ok  nginx:alpine
ok  busybox:latest              ok  nhost/hasura-auth:latest
ok  getmeili/meilisearch:v1.5   ok  nself/nself-admin:latest
ok  hasura/graphql-engine:v2.36.0   ok  postgres:16-alpine
ok  quay.io/minio/minio:latest

9/9 resolve. minio was the only failure before this change — matching the job log exactly.

Scope

backend/docker-compose.yml (what CI starts), the three deploy/docker compose files, the k8s manifest, the CLI services wiki page, and the storage issue template.

One thing to call out

backend/docker-compose.yml is marked # GENERATED BY nself build — DO NOT HAND EDIT. Editing it here is a deliberate deviation: main is red today and the generator fix (nself-org/cli#424, which moves the pin and adds a daily gate that resolves every default image) is not released yet. The durable fix is regenerating this file once that CLI ships.

Separately, a generated compose file arguably should not be tracked at all under the org's generated-file rule. I have not de-tracked it here — that is not something to slip into a CI fix.

[acamarata]

Update: the Generated File Gate blocked its own repo's fix

The first push failed Hygiene Checks:

ERROR: Refusing to commit generated file. Add to .gitignore first.
  -> backend/docker-compose.yml

That is two gates in the same workflow disagreeing. The Doc-Sync step carves this file out by name:

Exception: backend/docker-compose.yml is tracked for CI E2E provisioning (nself start --skip-build needs the file at checkout). It introduces no new ports […] See .github/wiki/E2E-Backend-Setup.md.

The Generated File Gate did not. So the file was declared legitimately tracked by one gate and made permanently uneditable by the other — which is precisely how it stayed pinned to an image Docker Hub had deleted.

I have amended the Generated File Gate rather than working around it. My earlier note in the PR body called the edit a deviation; with the Doc-Sync carve-out in view that reading was wrong — the file is tracked by explicit design, and the missing carve-out is the defect.

The carve-out is verified, not blanket

This gate exists to stop generated files carrying plaintext credentials into a public repo (the ntask incident: a generated compose with the postgres password, Hasura admin secret and JWT keys). That is preserved. All 21 credential-shaped keys in this file are ${...} references today, and the gate now asserts it on every commit:

OK: backend/docker-compose.yml is generated and tracked by design
    (CI E2E provisioning); no literal credentials.

Exercised in the failing direction — one ${POSTGRES_PASSWORD} replaced with a literal:

ERROR: … it now carries literal credential values.
    61:      POSTGRES_PASSWORD: hunter2-literal-test

Every other generated file is refused exactly as before. The gate is now stricter about this file than it was: before, the file was simply unmodifiable, and nothing ever checked its contents for literals.

[github-actions]

PR Checks Summary

Check	Status
Lint & Format	✅ success
Type Check	✅ success
Unit Tests	⏭️ skipped
Build	✅ success

---

✅ All checks passed! Ready for review.

[acamarata]

Closing in favour of #179, which now carries both commits from this branch.

These two PRs were blocking each other: this one fails Security Gate (it branches from main, which carries the 20 high CVEs fixed in #179), and #179 fails Accessibility E2E Tests (that job starts the nself stack, which cannot pull minio/minio — the fix is here). Neither could go green alone, so they are combined.

The MinIO change and the Generated File Gate carve-out are unchanged, cherry-picked as 575ca957 and b04ad8f7. The upstream generator fix is nself-org/cli#424, now merged.