fix: Nomad service deploys actually schedule + pull images

Dockerfile

@@ -33,6 +33,15 @@ ENV NODE_ENV=production
 
 RUN apt-get update && apt-get install -y curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
 
+# Nomad CLI — the deploy pipeline runs `nomad job run` to submit jobs to the
+# control plane's own Nomad. (Remote-server deploys use that server's own CLI.)
+ARG TARGETARCH
+ARG NOMAD_VERSION=2.0.5
+RUN curl -fsSL "https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_linux_${TARGETARCH}.zip" -o /tmp/nomad.zip \
+    && unzip -o /tmp/nomad.zip -d /usr/local/bin/ \
+    && rm /tmp/nomad.zip \
+    && nomad --version
+
 # Copy only the necessary files
 COPY --from=build /prod/nomploy/.next ./.next
 COPY --from=build /prod/nomploy/dist ./dist

install.sh

@@ -140,6 +140,13 @@ plugin "docker" {
 }
 NOMADHCL
 
+# The Nomad docker plugin above sets auth.config = /root/.docker/config.json.
+# If that file is missing, the docker driver fails to pull EVERY image (even
+# public ones). Create an empty auth config so public pulls work; `docker login`
+# later fills it in for private registries. Must exist before Nomad starts.
+$SUDO mkdir -p /root/.docker
+[ -s /root/.docker/config.json ] || echo '{"auths":{}}' | $SUDO tee /root/.docker/config.json >/dev/null
+
 # Start via --no-block and poll the HTTP APIs for readiness. The packaged units
 # are Type=notify; if the agent doesn't signal systemd, a blocking `restart`
 # would hang and (under set -e) abort the install even though the agent is up.

packages/server/src/setup/nomad-bootstrap.ts

@@ -167,6 +167,12 @@ plugin "docker" {
 }
 NOMADHCL
 
+# The docker plugin's auth.config points at /root/.docker/config.json; if it's
+# missing the driver fails to pull ANY image (even public). Create an empty auth
+# config (docker login later fills it for private registries). Before start.
+$SUDO mkdir -p /root/.docker
+[ -s /root/.docker/config.json ] || echo '{"auths":{}}' | $SUDO tee /root/.docker/config.json >/dev/null
+
 # ── Enable + start services ───────────────────────────────────────────────
 echo "==> Starting Consul and Nomad"
 $SUDO systemctl enable consul nomad