keep registry accounts for the whole cluster and use them everywhere

- Registry accounts are kept in /etc/pve/priv/proxmenux/registry-auth.json, shared by every node, unless REGISTRY_AUTH_FILE says otherwise
- The custom image importer offers to sign in when a registry refuses an image, and reads it again
- Installers, updates, the watchdog and the Monitor update check read private images with the saved accounts
- The host backup includes the accounts, and uninstalling ProxMenux removes them and keeps the OCI records of the cluster
- Spanish written by hand and spacing fixed for the registry account messages in every locale
- Docs: private registries section, Registry accounts in the OCI menu, README storage notes

oci/remote/install_immich_stack.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
+# A registry login saved by ProxMenux lets skopeo read private images.
+if [[ -z ${REGISTRY_AUTH_FILE:-} && -f /etc/pve/priv/proxmenux/registry-auth.json ]]; then
+  export REGISTRY_AUTH_FILE=/etc/pve/priv/proxmenux/registry-auth.json
+fi
 
 TEMPLATE_FILE=${1:?template JSON required}
 DEPLOYMENT_FILE=${2:?deployment JSON required}

oci/remote/install_nextcloud_stack.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
+# A registry login saved by ProxMenux lets skopeo read private images.
+if [[ -z ${REGISTRY_AUTH_FILE:-} && -f /etc/pve/priv/proxmenux/registry-auth.json ]]; then
+  export REGISTRY_AUTH_FILE=/etc/pve/priv/proxmenux/registry-auth.json
+fi
 
 TEMPLATE_FILE=${1:?template JSON required}
 DEPLOYMENT_FILE=${2:?deployment JSON required}

oci/remote/install_oci.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
+# A registry login saved by ProxMenux lets skopeo read private images.
+if [[ -z ${REGISTRY_AUTH_FILE:-} && -f /etc/pve/priv/proxmenux/registry-auth.json ]]; then
+  export REGISTRY_AUTH_FILE=/etc/pve/priv/proxmenux/registry-auth.json
+fi
 
 TEMPLATE_FILE=${1:?template JSON required}
 DEPLOYMENT_FILE=${2:?deployment JSON required}

oci/remote/install_paperless_stack.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
+# A registry login saved by ProxMenux lets skopeo read private images.
+if [[ -z ${REGISTRY_AUTH_FILE:-} && -f /etc/pve/priv/proxmenux/registry-auth.json ]]; then
+  export REGISTRY_AUTH_FILE=/etc/pve/priv/proxmenux/registry-auth.json
+fi
 
 TEMPLATE_FILE=${1:?template JSON required}
 DEPLOYMENT_FILE=${2:?deployment JSON required}

oci/remote/install_tandoor_stack.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
+# A registry login saved by ProxMenux lets skopeo read private images.
+if [[ -z ${REGISTRY_AUTH_FILE:-} && -f /etc/pve/priv/proxmenux/registry-auth.json ]]; then
+  export REGISTRY_AUTH_FILE=/etc/pve/priv/proxmenux/registry-auth.json
+fi
 
 TEMPLATE_FILE=${1:?template JSON required}
 DEPLOYMENT_FILE=${2:?deployment JSON required}

oci/remote/oci_installation_state.py

@@ -19,6 +19,11 @@ import uuid
 
 from oci_ui import translate, msg_error, msg_ok
 
+# A registry login saved by ProxMenux lets skopeo read private images.
+REGISTRY_AUTH_FILE = '/etc/pve/priv/proxmenux/registry-auth.json'
+if not os.environ.get('REGISTRY_AUTH_FILE') and os.path.isfile(REGISTRY_AUTH_FILE):
+    os.environ['REGISTRY_AUTH_FILE'] = REGISTRY_AUTH_FILE
+
 ROOT = Path('/var/lib/proxmenux/oci-installations')
 FIELDS = ('Entrypoint', 'Cmd', 'Env', 'User', 'WorkingDir', 'StopSignal', 'Volumes', 'ExposedPorts', 'Healthcheck')
 VERSION_ENV_RE = re.compile(r'^([A-Z][A-Z0-9_]*)_VERSION$')

oci/remote/oci_update_current.py

@@ -16,6 +16,11 @@ import oci_work_backup as work_backup
 from oci_installation_state import image_from_archive, same_image
 from oci_ui import translate, msg_info, msg_ok, msg_warn, msg_error, msg_info2
 
+# A registry login saved by ProxMenux lets skopeo read private images.
+REGISTRY_AUTH_FILE = '/etc/pve/priv/proxmenux/registry-auth.json'
+if not os.environ.get('REGISTRY_AUTH_FILE') and os.path.isfile(REGISTRY_AUTH_FILE):
+    os.environ['REGISTRY_AUTH_FILE'] = REGISTRY_AUTH_FILE
+
 
 def repository(reference):
     repo = reference.split('@', 1)[0]