fix(ci): use /dockerhub/ prefix для Nexus proxy путей

.gitlab-ci.yml

@@ -98,7 +98,7 @@ default:
 # содержит весь changelog со всеми историческими commit'ами — false positive.
 commit-msg-lint:
   stage: test
-  image: repo.nstart.cloud/library/alpine:3.20
+  image: repo.nstart.cloud/dockerhub/library/alpine:3.20
   script:
     # Runner не имеет outbound к dl-cdn.alpinelinux.org (Permission denied) —
     # переадресуем apk на internal Nexus mirror. Это нужно во всех Alpine
@@ -174,7 +174,7 @@ commit-msg-lint:
 # ─── TEST ──────────────────────────────────────
 maven-test:
   stage: test
-  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
+  image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
   script:
     - mvn $MAVEN_CLI_OPTS verify
   artifacts:
@@ -193,9 +193,9 @@ maven-test:
 # не имеет Docker.
 maven-e2e:
   stage: test
-  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
+  image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
   services:
-    - name: repo.nstart.cloud/library/docker:29.1.2-dind
+    - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
       alias: docker
       command: ["--tls=false"]
   variables:
@@ -221,7 +221,7 @@ maven-e2e:
 # на hot paths (parseRef, OnCloseAction, schema traversal).
 maven-bench:
   stage: test
-  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
+  image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
   script:
     - mvn $MAVEN_CLI_OPTS -P bench -pl ordinis-bench -am package -DskipTests
     # Quick smoke: 1 fork, 2 warmups, 3 measurements × 2s. Total ~5 min.
@@ -247,7 +247,7 @@ maven-bench:
 # идентичных jar'ов ~30 sec.
 maven-package:
   stage: build
-  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
+  image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
   script:
     - mvn $MAVEN_CLI_OPTS package -DskipTests
   artifacts:
@@ -262,7 +262,7 @@ maven-package:
 # не выдаёт errors на изменения docs/**.
 build-docs:
   stage: build
-  image: repo.nstart.cloud/library/node:20-alpine
+  image: repo.nstart.cloud/dockerhub/library/node:20-alpine
   before_script:
     # npm install pnpm — corepack может hang на CI runner integrity checks.
     - npm install -g --silent pnpm@9.15.4
@@ -298,7 +298,7 @@ build-docs:
   stage: publish
   image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
   services:
-    - name: repo.nstart.cloud/library/docker:29.1.2-dind
+    - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
       alias: docker
       command: ["--tls=false"]
   # docker-builds группа залипла в GitLab Sidekiq после force-cancel зомби
@@ -467,7 +467,7 @@ docker-docs:
   stage: publish
   image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
   services:
-    - name: repo.nstart.cloud/library/docker:29.1.2-dind
+    - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
       alias: docker
       command: ["--tls=false"]
   resource_group: docker-builds-v2
@@ -544,7 +544,7 @@ retag-docs:
 
 resolve-tag:
   stage: trigger-deploy
-  image: repo.nstart.cloud/library/alpine:3.20
+  image: repo.nstart.cloud/dockerhub/library/alpine:3.20
   script:
     - echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env
     # DOCS_IMAGE_TAG может быть пустым если docker-docs не пересобирался
@@ -624,7 +624,7 @@ release:
   # Pinned к alpine3.20 (не latest) — Nexus mirror APKINDEX для v3.23
   # рассинхронизирован с filesystem (claims old version, only newer files exist).
   # v3.20 mirror consistent, apk add работает. См. ci/apk-update-fix история.
-  image: repo.nstart.cloud/library/node:22-alpine3.20
+  image: repo.nstart.cloud/dockerhub/library/node:22-alpine3.20
   # Раньше `needs: trigger-deploy-staging` блокировал release когда staging
   # deploy hang'ался (helm pending-upgrade cascade — каждый retry оставлял
   # stuck revision, helm wait timeout 15m → rollback → next pipeline стартует
@@ -739,7 +739,7 @@ release:
 # Allow_failure: true — manual deploy backup path остаётся если что.
 commit-prod-image-bump:
   stage: release
-  image: repo.nstart.cloud/library/alpine:3.20
+  image: repo.nstart.cloud/dockerhub/library/alpine:3.20
   needs:
     # На tag pipeline images приходят через retag-* (не docker-*) после
     # !205 (ci/retag-on-tag-pipeline). Поэтому needs ссылается на retag-*.

docs/Dockerfile

@@ -2,8 +2,8 @@
 # Stage 1: build HTML через @diplodoc/cli (yfm).
 # Stage 2: nginx serving static files на /docs/ path.
 
-ARG NODE_IMAGE=repo.nstart.cloud/library/node:20-alpine
+ARG NODE_IMAGE=repo.nstart.cloud/dockerhub/library/node:20-alpine
-ARG NGINX_IMAGE=repo.nstart.cloud/library/nginx:1.27-alpine
+ARG NGINX_IMAGE=repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine
 
 # ─── Stage 1: Build HTML ─────────────────────
 FROM ${NODE_IMAGE} AS builder

ordinis-admin-ui/Dockerfile

@@ -1,4 +1,4 @@
-FROM repo.nstart.cloud/library/node:22-alpine AS build
+FROM repo.nstart.cloud/dockerhub/library/node:22-alpine AS build
 # Build identity для VersionBadge / UpdateBanner. Внутри Docker build context
 # нет .git/ (BUILD_CONTEXT=ordinis-admin-ui/), vite execSync падает →
 # fallback "unknown" / package.json. CI передаёт реальные значения через
@@ -26,7 +26,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --froze
 COPY . .
 RUN pnpm build
 
-FROM repo.nstart.cloud/library/nginx:1.27-alpine
+FROM repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 # Шаблон обрабатывается официальным entrypoint nginx-image:
 # /docker-entrypoint.d/20-envsubst-on-templates.sh пробегает по

ordinis-app/Dockerfile

@@ -8,7 +8,7 @@
 #
 # .dockerignore исключает frontend (admin-ui), bench, docs, target/, .git/,
 # IDE metadata — backend image остаётся компактным.
-FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
+FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
 # Git info из CI environment (`.gitlab-ci.yml` `--build-arg`) — нужен для
 # Spring Boot build-info goal через ordinis-app/pom.xml. Внутри Docker
 # context .git/ исключён (.dockerignore), поэтому git-commit-id-maven-plugin
@@ -29,7 +29,7 @@ RUN mvn -B -pl ordinis-app -am package -DskipTests \
     -Dgit.tags="$GIT_TAG" \
     -Dgit.commit.time="$GIT_TIME"
 
-FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
+FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
 # Non-root user — security hardening (CSO report 2026-05-27 finding #1).
 # Eclipse-temurin runtime image не задаёт USER by default → JVM от root.
 # Compromise через Spring Boot CVE / Jackson deserialization без USER

ordinis-migrations/Dockerfile

@@ -1,5 +1,5 @@
 # Liquibase migration image — запускается Helm pre-upgrade Job (1-shot, без Spring Boot)
-FROM repo.nstart.cloud/liquibase/liquibase:4.27.0
+FROM repo.nstart.cloud/dockerhub/liquibase/liquibase:4.27.0
 
 USER root
 COPY src/main/resources/db/changelog /liquibase/changelog

ordinis-projection-writer/Dockerfile

@@ -1,12 +1,12 @@
 # Multi-stage build для ordinis-projection-writer. См. ordinis-app/Dockerfile
 # для rationale `COPY . ./` + `.dockerignore` подхода (single-rule,
 # future-proof на новые Maven modules).
-FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
+FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
 WORKDIR /build
 COPY . ./
 RUN mvn -B -pl ordinis-projection-writer -am package -DskipTests
 
-FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
+FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
 # Non-root user — security hardening (CSO report 2026-05-27 finding #1).
 # См. ordinis-app/Dockerfile для rationale.
 RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app

ordinis-read-api/Dockerfile

@@ -1,12 +1,12 @@
 # Multi-stage build для ordinis-read-api. См. ordinis-app/Dockerfile для
 # rationale `COPY . ./` + `.dockerignore` подхода (single-rule, future-proof
 # на новые Maven modules).
-FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
+FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
 WORKDIR /build
 COPY . ./
 RUN mvn -B -pl ordinis-read-api -am package -DskipTests
 
-FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
+FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
 # Non-root user — security hardening (CSO report 2026-05-27 finding #1).
 # См. ordinis-app/Dockerfile для rationale (compromise → root в контейнере
 # = escalation surface на ноду). UID 10001 outside system+distro reserved.