bootstrap.sh: add --gitea-token / HOMELAB_GITEA_TOKEN

Each non-hubris client needs HTTPS auth against gitea for the initial
context clone (chicken-and-egg: a PAT stored in SOPS can't be fetched
until after the clone exists). Adds a --gitea-token flag that writes
credentials to /etc/homelab-context/git-credentials and points git's
credential.helper at it, so the clone and all future pulls succeed
without prompting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -27,6 +27,8 @@ MCP_URL="${HOMELAB_MCP_URL:-http://apps.netbird.selfhosted:9810/sse}"
 WITH_MCP=0
 DRY_RUN=0
 NO_SECRETS=0
+GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}"
+GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}"
 
 # -------- flag parsing --------
 while [ $# -gt 0 ]; do
@@ -34,6 +36,8 @@ while [ $# -gt 0 ]; do
         --with-mcp)    WITH_MCP=1; shift ;;
         --dry-run)     DRY_RUN=1; shift ;;
         --no-secrets)  NO_SECRETS=1; shift ;;
+        --gitea-token) GITEA_TOKEN="$2"; shift 2 ;;
+        --gitea-user)  GITEA_USER="$2"; shift 2 ;;
         --help|-h)
             sed -n '2,11p' "$0" | sed 's/^# *//'
             exit 0
@@ -43,6 +47,26 @@ while [ $# -gt 0 ]; do
     esac
 done
 
+# If a gitea token is provided, write it to the standard credential store
+# BEFORE the clone happens. The HTTPS REPO_HTTPS will then pick it up via
+# git's credential helper.
+configure_gitea_creds() {
+    if [ -z "$GITEA_TOKEN" ]; then return 0; fi
+    local creds_dir=/etc/homelab-context
+    local creds_file=$creds_dir/git-credentials
+    mkdir -p "$creds_dir"
+    chmod 700 "$creds_dir"
+    # Format the credential URL: protocol://user:token@host
+    # Extract host from REPO_HTTPS for the credential line.
+    local host
+    host=$(echo "$REPO_HTTPS" | sed -E 's|^https?://([^/]+).*|\1|')
+    printf 'https://%s:%s@%s\n' "$GITEA_USER" "$GITEA_TOKEN" "$host" > "$creds_file"
+    chmod 600 "$creds_file"
+    # Point git at this store globally for root (so future pulls work too).
+    git config --global credential.helper "store --file=$creds_file"
+    echo "[bootstrap] wrote gitea credentials to $creds_file"
+}
+
 run() {
     if [ "$DRY_RUN" -eq 1 ]; then
         printf '+ %s\n' "$*"
@@ -106,6 +130,9 @@ if [ -z "$MESH_CONNECTED" ] && [ "$NO_SECRETS" -eq 0 ]; then
 fi
 echo "[bootstrap] mesh: ${MESH_CONNECTED:-none (skipped, --no-secrets)}"
 
+# -------- gitea creds (if provided) --------
+configure_gitea_creds
+
 # -------- clone --------
 if [ -d "$CLONE_DIR/.git" ]; then
     existing_remote="$(git -C "$CLONE_DIR" remote get-url origin 2>/dev/null || true)"