From 0a4330b4a8c570d329350be865397f6618c20139 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:04:01 +0100
Subject: [PATCH 01/12] Add LEGACY_NETWORK variable to environment files

---
 dev.env             | 3 ++-
 docker-compose.yaml | 2 +-
 prod.env            | 3 ++-
 staging.env         | 3 ++-
 4 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/dev.env b/dev.env
index e42f23f..552bea3 100644
--- a/dev.env
+++ b/dev.env
@@ -4,4 +4,5 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
\ No newline at end of file
+TRAEFIK_LEGACY_OPT=
+LEGACY_NETWORK=
\ No newline at end of file
diff --git a/docker-compose.yaml b/docker-compose.yaml
index b2848ae..de41d4e 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -6,7 +6,7 @@ services:
       - no-new-privileges:true
     networks:
       - proxy
-      - legacy-nginx
+      - ${LEGACY_NETWORK:-}
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
diff --git a/prod.env b/prod.env
index 302deeb..dfce473 100644
--- a/prod.env
+++ b/prod.env
@@ -4,4 +4,5 @@ ENV=prod
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
-TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
\ No newline at end of file
+TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
+LEGACY_NETWORK=legacy-nginx
\ No newline at end of file
diff --git a/staging.env b/staging.env
index 38ab2dc..f4d62a2 100644
--- a/staging.env
+++ b/staging.env
@@ -4,4 +4,5 @@ ENV=staging
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
\ No newline at end of file
+TRAEFIK_LEGACY_OPT=
+LEGACY_NETWORK=
\ No newline at end of file
-- 
2.49.1


From 06db4ed78836c33e63da17cca936e0aa2ce4d3bd Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:15:30 +0100
Subject: [PATCH 02/12] Moved to extra_networks

---
 dev.env             | 2 +-
 docker-compose.yaml | 2 +-
 prod.env            | 2 +-
 staging.env         | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dev.env b/dev.env
index 552bea3..b1bbeae 100644
--- a/dev.env
+++ b/dev.env
@@ -5,4 +5,4 @@ NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
 TRAEFIK_LEGACY_OPT=
-LEGACY_NETWORK=
\ No newline at end of file
+EXTRA_NETWORK=proxy
\ No newline at end of file
diff --git a/docker-compose.yaml b/docker-compose.yaml
index de41d4e..a48bdaa 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -6,7 +6,7 @@ services:
       - no-new-privileges:true
     networks:
       - proxy
-      - ${LEGACY_NETWORK:-}
+      - ${EXTRA_NETWORK}
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
diff --git a/prod.env b/prod.env
index dfce473..4deb347 100644
--- a/prod.env
+++ b/prod.env
@@ -5,4 +5,4 @@ NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
 TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
-LEGACY_NETWORK=legacy-nginx
\ No newline at end of file
+EXTRA_NETWORK=legacy-nginx
\ No newline at end of file
diff --git a/staging.env b/staging.env
index f4d62a2..a8cccea 100644
--- a/staging.env
+++ b/staging.env
@@ -5,4 +5,4 @@ NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
 TRAEFIK_LEGACY_OPT=
-LEGACY_NETWORK=
\ No newline at end of file
+EXTRA_NETWORK=proxy
\ No newline at end of file
-- 
2.49.1


From 772832200d100198284aa4a5b5f27239e6555350 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:31:30 +0100
Subject: [PATCH 03/12] Added new pipeline

---
 .gitea/workflows/workflow.yaml | 279 ++++++++++++++-------------------
 dev.env                        |   3 +-
 docker-compose.prod.yaml       |  50 ++++++
 docker-compose.yaml            |   1 -
 prod.env                       |   3 +-
 staging.env                    |   3 +-
 6 files changed, 172 insertions(+), 167 deletions(-)
 create mode 100644 docker-compose.prod.yaml

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 4636b65..741f9ff 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -8,202 +8,161 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 env:
-  # Base path for PR preview environments
+  # --- PATH CONFIGURATION ---
   REMOTE_DEPLOY_PATH: /var/app/traefik/test
-
-  # --- CUSTOMIZABLE PRODUCTION PATH ---
-  # Set the absolute path for your production deployment on the remote server.
   REMOTE_PROD_PATH: /var/app/traefik/prod
-
   REMOTE_STAGING_PATH: /var/app/traefik/staging
 
+  # --- SECRETS ---
   SSH_HOST: ${{ secrets.SSH_HOST }}
   SSH_USER: ${{ secrets.SSH_USER }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
   SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 
 jobs:
-  prepare_deployment_vars:
-    name: Prepare deployment vars
+  # ------------------------------------------------------------------
+  # STAGE 1: PREPARE
+  # Calculate dynamic paths (like PR folders) so other jobs can use them
+  # ------------------------------------------------------------------
+  prepare_context:
+    name: Prepare Context
     runs-on: ubuntu-latest
     outputs:
-      deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
+      pr_path: ${{ steps.calc.outputs.pr_path }}
     steps:
-      - name: Set deployment variables
-        id: set-vars
+      - id: calc
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
+          # Only needed for PRs
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            # For PRs, create a unique directory under the base path
-            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
-          else
-            # For 'main' branch, use the specified production path.
-            # Fallback to a default if REMOTE_PROD_PATH is empty.
-            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
+            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
           fi
-          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
-          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
-          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
 
-  create_remote_directory:
-    name: Create remote directory
+  # ------------------------------------------------------------------
+  # STAGE 2: DEPLOY PREVIEW (DEV)
+  # Runs only on Pull Requests
+  # ------------------------------------------------------------------
+  deploy_preview:
+    name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: prepare_deployment_vars
-    if: |
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
-      || github.ref == 'refs/heads/main'
+    needs: prepare_context
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+      - uses: actions/checkout@v4
+      - uses: webfactory/ssh-agent@v0.9.0
+        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
 
-      - name: Add host to known_hosts
+      - name: Sync & Build
         run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
+          # 1. Setup Known Hosts
+          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
+          
+          # 2. Define Target
+          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
+          
+          # 3. Create Remote Dir
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
 
-      - name: Create directory on remote
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
+          # 4. Sync Files (Exclude .git to save bandwidth)
+          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
+            --exclude '.git/' --exclude '.github/' \
+            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-  sync_repo_files:
-    name: Sync repository files
+          # 5. Build and Run on Server
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
+            cd '$TARGET'
+            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
+          "
+
+  # ------------------------------------------------------------------
+  # STAGE 3: DEPLOY STAGING
+  # Runs on 'main'. Always runs before Prod.
+  # ------------------------------------------------------------------
+  deploy_staging:
+    name: Deploy (Staging)
     runs-on: ubuntu-latest
-    needs: [create_remote_directory, prepare_deployment_vars]
-    if: |
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
-      || github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main'
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+      - uses: actions/checkout@v4
+      - uses: webfactory/ssh-agent@v0.9.0
+        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
 
-      - name: Sync files via scp
-        uses: appleboy/scp-action@master
-        with:
-          host: ${{ env.SSH_HOST }}
-          username: ${{ env.SSH_USER }}
-          key: ${{ env.SSH_PRIVATE_KEY }}
-          port: ${{ env.SSH_PORT }}
-          source: "./"
-          target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+      - name: Sync & Build
+        run: |
+          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
+          
+          TARGET="${{ env.REMOTE_STAGING_PATH }}"
+          
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
 
-      - name: Sync file via scp (staging)
-        if: github.ref == 'refs/heads/main'
-        uses: appleboy/scp-action@master
-        with:
-          host: ${{ env.SSH_HOST }}
-          username: ${{ env.SSH_USER }}
-          key: ${{ env.SSH_PRIVATE_KEY }}
-          port: ${{ env.SSH_PORT }}
-          source: "./"
-          target: ${{ env.REMOTE_STAGING_PATH }}
+          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
+            --exclude '.git/' --exclude '.github/' \
+            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-  run_docker_compose_dev:
-    name: Run docker-compose remotely (Dev)
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
+            cd '$TARGET'
+            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
+          "
+
+  # ------------------------------------------------------------------
+  # STAGE 4: DEPLOY PRODUCTION
+  # Runs on 'main'. DEPENDS ON STAGING SUCCESS.
+  # ------------------------------------------------------------------
+  deploy_prod:
+    name: Deploy (Production)
     runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+    needs: deploy_staging # <--- This is the key logic separation
+    if: github.ref == 'refs/heads/main'
     steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+      - uses: actions/checkout@v4
+      - uses: webfactory/ssh-agent@v0.9.0
+        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
 
-      - name: Add host to known_hosts
+      - name: Sync & Build
         run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
+          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
+          
+          TARGET="${{ env.REMOTE_PROD_PATH }}"
+          
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
 
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
+          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
+            --exclude '.git/' --exclude '.github/' \
+            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-  run_docker_compose_staging:
-    name: Run docker-compose remotely (Staging)
+          # Note: Since Staging just built this commit on the same server, 
+          # this build step will be nearly instant (using Docker cache).
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
+            cd '$TARGET'
+            docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
+          "
+
+  # ------------------------------------------------------------------
+  # CLEANUP (On PR Close)
+  # ------------------------------------------------------------------
+  cleanup:
+    name: Cleanup Preview
     runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.ref == 'refs/heads/main')
+    needs: prepare_context
+    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+      - uses: webfactory/ssh-agent@v0.9.0
+        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
 
-      - name: Add host to known_hosts
+      - name: Remove Remote Environment
         run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
-
-  run_docker_compose_prod:
-    name: Run docker-compose remotely (Prod)
-    runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.ref == 'refs/heads/main')
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
-
-  cleanup_mr_environment:
-    name: Cleanup MR environment
-    runs-on: ubuntu-latest
-    needs: prepare_deployment_vars
-    if: |
-      github.event_name == 'pull_request' && 
-      (github.event.action == 'closed' || github.event.pull_request.merged == true)
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose down on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
-
-      - name: Delete deployment directory
-        run: |
-          ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"
+          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
+          
+          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
+          
+          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
+            if [ -d '$TARGET' ]; then
+              cd '$TARGET'
+              docker compose down -v || true
+              cd ..
+              rm -rf '$TARGET'
+              echo 'Cleanup successful'
+            else
+              echo 'Directory not found, skipping.'
+            fi
+          "
\ No newline at end of file
diff --git a/dev.env b/dev.env
index b1bbeae..e42f23f 100644
--- a/dev.env
+++ b/dev.env
@@ -4,5 +4,4 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
-EXTRA_NETWORK=proxy
\ No newline at end of file
+TRAEFIK_LEGACY_OPT=
\ No newline at end of file
diff --git a/docker-compose.prod.yaml b/docker-compose.prod.yaml
new file mode 100644
index 0000000..9e929e2
--- /dev/null
+++ b/docker-compose.prod.yaml
@@ -0,0 +1,50 @@
+services:
+  traefik:
+    image: "traefik:v3.6@sha256:aaf0f6185419a50c74651448c1a5bf4606bd2d2ddb7b8749eed505d55bf8b8ea"
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - proxy
+    command:
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=proxy"
+      - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
+      - "--entryPoints.web.address=:80"
+      - "--entryPoints.https.address=:443"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
+      - "${TRAEFIK_LEGACY_OPT:-}"
+      - "--providers.file.watch=true"
+    ports:
+      - "${PORT}:80"
+      - "${HTTPS_PORT}:443"
+      - "8080"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "./data/letsencrypt:/letsencrypt"
+      - "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
+
+  whoami:
+    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "env=${ENV}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
+      - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
+      - "traefik.http.routers.whoami.entrypoints=web"
+      - traefik.http.routers.https.entrypoints=https
+      - traefik.http.routers.https.tls=true
+      - traefik.http.routers.https.tls.certresolver=letsencrypt
+networks:
+  proxy:
+  legacy-nginx:
+    name: proxy
+    external: true
diff --git a/docker-compose.yaml b/docker-compose.yaml
index a48bdaa..9e929e2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -6,7 +6,6 @@ services:
       - no-new-privileges:true
     networks:
       - proxy
-      - ${EXTRA_NETWORK}
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
diff --git a/prod.env b/prod.env
index 4deb347..302deeb 100644
--- a/prod.env
+++ b/prod.env
@@ -4,5 +4,4 @@ ENV=prod
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
-TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
-EXTRA_NETWORK=legacy-nginx
\ No newline at end of file
+TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
\ No newline at end of file
diff --git a/staging.env b/staging.env
index a8cccea..38ab2dc 100644
--- a/staging.env
+++ b/staging.env
@@ -4,5 +4,4 @@ ENV=staging
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
-EXTRA_NETWORK=proxy
\ No newline at end of file
+TRAEFIK_LEGACY_OPT=
\ No newline at end of file
-- 
2.49.1


From 615be8da9d5b95cbf1bee50f5905a2f2137199d2 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:34:20 +0100
Subject: [PATCH 04/12] Add legacy-network-restriction branch to push triggers

---
 .gitea/workflows/workflow.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 741f9ff..477fc7c 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - legacy-network-restriction
   pull_request:
     types: [opened, synchronize, reopened, closed]
 
-- 
2.49.1


From 59236531473c5dc3092d1637d7c5766bc9fb1f83 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:39:17 +0100
Subject: [PATCH 05/12] Fix syntax

---
 .gitea/workflows/workflow.yaml | 45 ++++++++++++++--------------------
 1 file changed, 19 insertions(+), 26 deletions(-)

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 477fc7c..36a867d 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - legacy-network-restriction
   pull_request:
     types: [opened, synchronize, reopened, closed]
 
@@ -23,7 +22,6 @@ env:
 jobs:
   # ------------------------------------------------------------------
   # STAGE 1: PREPARE
-  # Calculate dynamic paths (like PR folders) so other jobs can use them
   # ------------------------------------------------------------------
   prepare_context:
     name: Prepare Context
@@ -34,42 +32,37 @@ jobs:
       - id: calc
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
-          # Only needed for PRs
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
           fi
 
   # ------------------------------------------------------------------
   # STAGE 2: DEPLOY PREVIEW (DEV)
-  # Runs only on Pull Requests
   # ------------------------------------------------------------------
   deploy_preview:
     name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: prepare_context
+    needs: 
+      - prepare_context
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
-          # 1. Setup Known Hosts
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
-          # 2. Define Target
           TARGET="${{ needs.prepare_context.outputs.pr_path }}"
           
-          # 3. Create Remote Dir
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
-
-          # 4. Sync Files (Exclude .git to save bandwidth)
+          
           rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
             --exclude '.git/' --exclude '.github/' \
             ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-          # 5. Build and Run on Server
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
             cd '$TARGET'
             docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
@@ -77,7 +70,6 @@ jobs:
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
-  # Runs on 'main'. Always runs before Prod.
   # ------------------------------------------------------------------
   deploy_staging:
     name: Deploy (Staging)
@@ -85,13 +77,14 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ env.REMOTE_STAGING_PATH }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
@@ -107,22 +100,23 @@ jobs:
 
   # ------------------------------------------------------------------
   # STAGE 4: DEPLOY PRODUCTION
-  # Runs on 'main'. DEPENDS ON STAGING SUCCESS.
   # ------------------------------------------------------------------
   deploy_prod:
     name: Deploy (Production)
     runs-on: ubuntu-latest
-    needs: deploy_staging # <--- This is the key logic separation
+    needs: 
+      - deploy_staging
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ env.REMOTE_PROD_PATH }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
@@ -131,29 +125,28 @@ jobs:
             --exclude '.git/' --exclude '.github/' \
             ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-          # Note: Since Staging just built this commit on the same server, 
-          # this build step will be nearly instant (using Docker cache).
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
             cd '$TARGET'
             docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
           "
 
   # ------------------------------------------------------------------
-  # CLEANUP (On PR Close)
+  # CLEANUP
   # ------------------------------------------------------------------
   cleanup:
     name: Cleanup Preview
     runs-on: ubuntu-latest
-    needs: prepare_context
+    needs: 
+      - prepare_context
     if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Remove Remote Environment
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ needs.prepare_context.outputs.pr_path }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
-- 
2.49.1


From a57e44ca6760decf917cbc4de47fa2cc2796c23f Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:44:44 +0100
Subject: [PATCH 06/12] Use github action instead

---
 .gitea/workflows/workflow.yaml | 139 +++++++++++++++------------------
 1 file changed, 61 insertions(+), 78 deletions(-)

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 36a867d..32d31b5 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -21,7 +21,7 @@ env:
 
 jobs:
   # ------------------------------------------------------------------
-  # STAGE 1: PREPARE
+  # STAGE 1: PREPARE CONTEXT
   # ------------------------------------------------------------------
   prepare_context:
     name: Prepare Context
@@ -42,31 +42,28 @@ jobs:
   deploy_preview:
     name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: 
-      - prepare_context
+    needs: [prepare_context]
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
       - uses: actions/checkout@v4
-      
-      - uses: webfactory/ssh-agent@v0.9.0
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
-      - name: Sync & Build
-        run: |
-          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
-          
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
-          
-          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
-            --exclude '.git/' --exclude '.github/' \
-            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
-
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
-            cd '$TARGET'
+      - name: Deploy via Rsync & Docker
+        uses: easingthemes/ssh-deploy@v5.0.0
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
+          # Exclude git internals to save bandwidth
+          EXCLUDE: ".git/, .github/"
+          # 1. Create directory first
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
+          # 2. Run Docker Compose after sync
+          SCRIPT_AFTER: |
+            cd ${{ needs.prepare_context.outputs.pr_path }}
             docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
-          "
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
@@ -77,26 +74,21 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
-      
-      - uses: webfactory/ssh-agent@v0.9.0
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
-      - name: Sync & Build
-        run: |
-          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          TARGET="${{ env.REMOTE_STAGING_PATH }}"
-          
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
-
-          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
-            --exclude '.git/' --exclude '.github/' \
-            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
-
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
-            cd '$TARGET'
+      - name: Deploy via Rsync & Docker
+        uses: easingthemes/ssh-deploy@v5.0.0
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ env.REMOTE_STAGING_PATH }}
+          EXCLUDE: ".git/, .github/"
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
+          SCRIPT_AFTER: |
+            cd ${{ env.REMOTE_STAGING_PATH }}
             docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
-          "
 
   # ------------------------------------------------------------------
   # STAGE 4: DEPLOY PRODUCTION
@@ -104,59 +96,50 @@ jobs:
   deploy_prod:
     name: Deploy (Production)
     runs-on: ubuntu-latest
-    needs: 
-      - deploy_staging
+    needs: [deploy_staging]
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
-      
-      - uses: webfactory/ssh-agent@v0.9.0
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
-      - name: Sync & Build
-        run: |
-          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          TARGET="${{ env.REMOTE_PROD_PATH }}"
-          
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
-
-          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
-            --exclude '.git/' --exclude '.github/' \
-            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
-
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
-            cd '$TARGET'
+      - name: Deploy via Rsync & Docker
+        uses: easingthemes/ssh-deploy@v5.0.0
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ env.REMOTE_PROD_PATH }}
+          EXCLUDE: ".git/, .github/"
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ env.REMOTE_PROD_PATH }}
+          SCRIPT_AFTER: |
+            cd ${{ env.REMOTE_PROD_PATH }}
             docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
-          "
 
   # ------------------------------------------------------------------
-  # CLEANUP
+  # CLEANUP (Using appleboy/ssh-action for pure command execution)
   # ------------------------------------------------------------------
   cleanup:
     name: Cleanup Preview
     runs-on: ubuntu-latest
-    needs: 
-      - prepare_context
+    needs: [prepare_context]
     if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
-      - uses: webfactory/ssh-agent@v0.9.0
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
       - name: Remove Remote Environment
-        run: |
-          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
-          
-          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
-            if [ -d '$TARGET' ]; then
-              cd '$TARGET'
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ env.SSH_HOST }}
+          username: ${{ env.SSH_USER }}
+          key: ${{ env.SSH_PRIVATE_KEY }}
+          port: ${{ env.SSH_PORT }}
+          script: |
+            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
+            if [ -d "$TARGET" ]; then
+              cd "$TARGET"
               docker compose down -v || true
               cd ..
-              rm -rf '$TARGET'
-              echo 'Cleanup successful'
+              rm -rf "$TARGET"
+              echo "Cleanup successful"
             else
-              echo 'Directory not found, skipping.'
-            fi
-          "
\ No newline at end of file
+              echo "Directory not found, skipping."
+            fi
\ No newline at end of file
-- 
2.49.1


From ba8b44d8a005c507d88bebef05758c792ec38fd2 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:48:17 +0100
Subject: [PATCH 07/12] Add prod compose

---
 docker-compose.prod.yaml | 43 +---------------------------------------
 docker-compose.yaml      |  5 +----
 2 files changed, 2 insertions(+), 46 deletions(-)

diff --git a/docker-compose.prod.yaml b/docker-compose.prod.yaml
index 9e929e2..dfbe234 100644
--- a/docker-compose.prod.yaml
+++ b/docker-compose.prod.yaml
@@ -1,50 +1,9 @@
 services:
   traefik:
-    image: "traefik:v3.6@sha256:aaf0f6185419a50c74651448c1a5bf4606bd2d2ddb7b8749eed505d55bf8b8ea"
-    restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     networks:
       - proxy
-    command:
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=proxy"
-      - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
-      - "--entryPoints.web.address=:80"
-      - "--entryPoints.https.address=:443"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
-      - "${TRAEFIK_LEGACY_OPT:-}"
-      - "--providers.file.watch=true"
-    ports:
-      - "${PORT}:80"
-      - "${HTTPS_PORT}:443"
-      - "8080"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./data/letsencrypt:/letsencrypt"
-      - "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
-
-  whoami:
-    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "env=${ENV}"
-      - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
-      - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - traefik.http.routers.https.entrypoints=https
-      - traefik.http.routers.https.tls=true
-      - traefik.http.routers.https.tls.certresolver=letsencrypt
+      - legacy-nginx
 networks:
-  proxy:
   legacy-nginx:
     name: proxy
     external: true
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 9e929e2..b76e317 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -44,7 +44,4 @@ services:
       - traefik.http.routers.https.tls=true
       - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
-  proxy:
-  legacy-nginx:
-    name: proxy
-    external: true
+  proxy:
\ No newline at end of file
-- 
2.49.1


From a1c128112dad331747bf809a5cc28b859e5eb2ad Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 17:59:10 +0100
Subject: [PATCH 08/12] Added testing network

---
 .gitea/workflows/workflow.yaml | 2 +-
 docker-compose.dev.yaml        | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 docker-compose.dev.yaml

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 32d31b5..b8bcbd7 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -63,7 +63,7 @@ jobs:
           # 2. Run Docker Compose after sync
           SCRIPT_AFTER: |
             cd ${{ needs.prepare_context.outputs.pr_path }}
-            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
+            docker compose --env-file dev.env -f docker-compose.yaml -f docker-compose.dev.yaml up -d --build --remove-orphans
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
diff --git a/docker-compose.dev.yaml b/docker-compose.dev.yaml
new file mode 100644
index 0000000..dfbe234
--- /dev/null
+++ b/docker-compose.dev.yaml
@@ -0,0 +1,9 @@
+services:
+  traefik:
+    networks:
+      - proxy
+      - legacy-nginx
+networks:
+  legacy-nginx:
+    name: proxy
+    external: true
-- 
2.49.1


From 78393c17c6324e4571e41a8a20321f6168af46c0 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 18:07:17 +0100
Subject: [PATCH 09/12] Finalize config

---
 .gitea/workflows/workflow.yaml | 5 +++--
 docker-compose.dev.yaml        | 9 ---------
 2 files changed, 3 insertions(+), 11 deletions(-)
 delete mode 100644 docker-compose.dev.yaml

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index b8bcbd7..3ec84c9 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -30,6 +30,7 @@ jobs:
       pr_path: ${{ steps.calc.outputs.pr_path }}
     steps:
       - id: calc
+        name: Prepare Context
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
@@ -63,7 +64,7 @@ jobs:
           # 2. Run Docker Compose after sync
           SCRIPT_AFTER: |
             cd ${{ needs.prepare_context.outputs.pr_path }}
-            docker compose --env-file dev.env -f docker-compose.yaml -f docker-compose.dev.yaml up -d --build --remove-orphans
+            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
@@ -114,7 +115,7 @@ jobs:
             mkdir -p ${{ env.REMOTE_PROD_PATH }}
           SCRIPT_AFTER: |
             cd ${{ env.REMOTE_PROD_PATH }}
-            docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
+            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans
 
   # ------------------------------------------------------------------
   # CLEANUP (Using appleboy/ssh-action for pure command execution)
diff --git a/docker-compose.dev.yaml b/docker-compose.dev.yaml
deleted file mode 100644
index dfbe234..0000000
--- a/docker-compose.dev.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-services:
-  traefik:
-    networks:
-      - proxy
-      - legacy-nginx
-networks:
-  legacy-nginx:
-    name: proxy
-    external: true
-- 
2.49.1


From 56128597872659a1c98df5656cf91b2d46aed1e2 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 18:11:52 +0100
Subject: [PATCH 10/12] Test cleanup

---
 .gitea/workflows/workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 3ec84c9..ddc042d 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -124,7 +124,7 @@ jobs:
     name: Cleanup Preview
     runs-on: ubuntu-latest
     needs: [prepare_context]
-    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
+    # if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - name: Remove Remote Environment
         uses: appleboy/ssh-action@v1.0.3
-- 
2.49.1


From 49fc0caebcd6e905307678938c03b1ef11ea6ee1 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 18:26:13 +0100
Subject: [PATCH 11/12] Use volume mount

---
 docker-compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index b76e317..e3af1fc 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -26,7 +26,7 @@ services:
       - "8080"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./data/letsencrypt:/letsencrypt"
+      - "letsencrypt:/letsencrypt"
       - "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
 
   whoami:
-- 
2.49.1


From 0732ae495eba5e5452e6f1dade0baa77e49b4cd8 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 29 Nov 2025 18:35:09 +0100
Subject: [PATCH 12/12] Undo if for cleanup

---
 .gitea/workflows/workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index ddc042d..3ec84c9 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -124,7 +124,7 @@ jobs:
     name: Cleanup Preview
     runs-on: ubuntu-latest
     needs: [prepare_context]
-    # if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
+    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - name: Remove Remote Environment
         uses: appleboy/ssh-action@v1.0.3
-- 
2.49.1