Add custom CI runner images: self-hosted registry, ssh-alpine image, biweekly rebuild

- Enabled GitLab Container Registry on its own subdomain via NPM/mkcert
- Built minimal ssh-alpine image (Alpine + OpenSSH, key-only auth)
- Docker-outside-of-Docker build pipeline reusing the host socket, no DinD
- Forced --pull --no-cache builds so scheduled rebuilds pick up real upstream updates
- Biweekly Pipeline Schedule (cron: 0 3 */14 * *)
- Registry cleanup policy to prevent unbounded tag growth
- Documented the Tailscale/Pi-hole DNS conflict and other gotchas hit along the way

docker-compose/gitlab/ci-images-reference/.gitlab-ci.yml

@@ -0,0 +1,24 @@
+stages:
+  - build
+
+.build-image:
+  stage: build
+  image: docker:27-cli
+  services: []   # not needed — we're using the host socket, not DinD
+  before_script:
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+  script:
+    - docker pull alpine:3.20
+    - docker build --pull --no-cache -t "$CI_REGISTRY_IMAGE/$IMAGE_NAME:latest" -t "$CI_REGISTRY_IMAGE/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA" "images/$IMAGE_NAME"
+    - docker push "$CI_REGISTRY_IMAGE/$IMAGE_NAME:latest"
+    - docker push "$CI_REGISTRY_IMAGE/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA"
+
+build-ssh-alpine:
+  extends: .build-image
+  variables:
+    IMAGE_NAME: ssh-alpine
+
+# Scheduled biweekly via GitLab's native Pipeline Schedules (Build > Pipeline
+# schedules), cron pattern: 0 3 */14 * *
+# Runs on both the schedule and regular pushes — no `rules` restriction —
+# so editing a Dockerfile also triggers an immediate rebuild.

docker-compose/gitlab/ci-images-reference/README.md

@@ -0,0 +1,5 @@
+# ci-images (reference copy)
+
+This folder mirrors the `.gitlab-ci.yml` and `Dockerfile`(s) from the `ci-images` project, which lives in the self-hosted GitLab instance (not GitHub) — kept here so the work is visible in this repo too. See [docs/CI-Custom-Images.md](../../../docs/CI-Custom-Images.md) for the full write-up.
+
+The live project has its own git history, pipeline runs, and pushes to the self-hosted Container Registry at `registry.gitlab.home` — this folder is documentation, not a working deployment target.

docker-compose/gitlab/ci-images-reference/images/ssh-alpine/Dockerfile

@@ -0,0 +1,17 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache openssh-server && \
+    ssh-keygen -A && \
+    adduser -D -s /bin/ash ciuser && \
+    mkdir -p /home/ciuser/.ssh && \
+    chmod 700 /home/ciuser/.ssh && \
+    chown -R ciuser:ciuser /home/ciuser/.ssh
+
+# Disable root login and password auth by default — key-based only.
+# Override at container runtime if a specific pipeline job genuinely needs
+# password auth (it shouldn't).
+RUN sed -i 's/#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
+    sed -i 's/#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+
+EXPOSE 22
+CMD ["/usr/sbin/sshd", "-D"]