From 107417aaac0b80ab9428ec4e91e5770d654a53ce Mon Sep 17 00:00:00 2001
From: Simon Cornet <simon@simoncor.net>
Date: Fri, 8 May 2026 13:23:07 +0200
Subject: [PATCH] fix: use and reference credentialfile

---
 tasks/config.yaml                      | 11 +++++++++++
 templates/zot/config.json.j2           |  9 +++------
 templates/zot/sync-credentials.json.j2 |  6 ++++++
 3 files changed, 20 insertions(+), 6 deletions(-)
 create mode 100644 templates/zot/sync-credentials.json.j2

diff --git a/tasks/config.yaml b/tasks/config.yaml
index 8de3086..40f6eb6 100644
--- a/tasks/config.yaml
+++ b/tasks/config.yaml
@@ -4,6 +4,17 @@
 - name: "configure zot"
   block:
 
+    # create sync credentials file
+    - name: "create sync credentials file"
+      ansible.builtin.template:
+        src: "zot/sync-credentials.json.j2"
+        dest: "/etc/zot/sync-credentials.json"
+        owner: "root"
+        group: "root"
+        mode: "0600"
+      notify: "restart zot"
+      when: "zot_dockerhub_username is defined and zot_dockerhub_password is defined"
+
     # create config file
     - name: "create config file"
       ansible.builtin.template:
diff --git a/templates/zot/config.json.j2 b/templates/zot/config.json.j2
index acedecc..601ae8d 100644
--- a/templates/zot/config.json.j2
+++ b/templates/zot/config.json.j2
@@ -41,15 +41,12 @@
     },
     "sync": {
       "enable": true,
+{% if zot_dockerhub_username is defined and zot_dockerhub_password is defined %}
+      "credentialsFile": "/etc/zot/sync-credentials.json",
+{% endif %}
       "registries": [
         {
           "urls": ["https://registry-1.docker.io"],
-{% if zot_dockerhub_username is defined and zot_dockerhub_password is defined %}
-          "credentials": {
-            "username": "{{ zot_dockerhub_username }}",
-            "password": "{{ zot_dockerhub_password }}"
-          },
-{% endif %}
           "onDemand": true,
           "tlsVerify": true,
           "maxRetries": 3,
diff --git a/templates/zot/sync-credentials.json.j2 b/templates/zot/sync-credentials.json.j2
new file mode 100644
index 0000000..56564e8
--- /dev/null
+++ b/templates/zot/sync-credentials.json.j2
@@ -0,0 +1,6 @@
+{
+  "registry-1.docker.io": {
+    "username": "{{ zot_dockerhub_username }}",
+    "password": "{{ zot_dockerhub_password }}"
+  }
+}