.gitea/workflows/workflow.yaml

@@ -8,202 +8,139 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 env:
-  # Base path for PR preview environments
+  # --- PATH CONFIGURATION ---
   REMOTE_DEPLOY_PATH: /var/app/traefik/test
-
-  # --- CUSTOMIZABLE PRODUCTION PATH ---
-  # Set the absolute path for your production deployment on the remote server.
   REMOTE_PROD_PATH: /var/app/traefik/prod
-
   REMOTE_STAGING_PATH: /var/app/traefik/staging
 
+  # --- SECRETS ---
   SSH_HOST: ${{ secrets.SSH_HOST }}
   SSH_USER: ${{ secrets.SSH_USER }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
   SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 
 jobs:
-  prepare_deployment_vars:
+  # ------------------------------------------------------------------
-    name: Prepare deployment vars
+  # STAGE 1: PREPARE CONTEXT
+  # ------------------------------------------------------------------
+  prepare_context:
+    name: Prepare Context
     runs-on: ubuntu-latest
     outputs:
-      deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
+      pr_path: ${{ steps.calc.outputs.pr_path }}
     steps:
-      - name: Set deployment variables
+      - id: calc
-        id: set-vars
+        name: Prepare Context
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            # For PRs, create a unique directory under the base path
+            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
-            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
-          else
-            # For 'main' branch, use the specified production path.
-            # Fallback to a default if REMOTE_PROD_PATH is empty.
-            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
           fi
-          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
-          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
-          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
 
-  create_remote_directory:
+  # ------------------------------------------------------------------
-    name: Create remote directory
+  # STAGE 2: DEPLOY PREVIEW (DEV)
+  # ------------------------------------------------------------------
+  deploy_preview:
+    name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: prepare_deployment_vars
+    needs: [prepare_context]
-    if: |
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
-      || github.ref == 'refs/heads/main'
     steps:
-      - name: Setup SSH
+      - uses: actions/checkout@v4
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
-      - name: Add host to known_hosts
+      - name: Deploy via Rsync & Docker
-        run: |
+        uses: easingthemes/ssh-deploy@v5.0.0
-          mkdir -p ~/.ssh
+        env:
-          chmod 700 ~/.ssh
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+          REMOTE_HOST: ${{ env.SSH_HOST }}
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+          REMOTE_USER: ${{ env.SSH_USER }}
-            exit 1
+          REMOTE_PORT: ${{ env.SSH_PORT }}
-          }
+          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
-          chmod 644 ~/.ssh/known_hosts
+          # Exclude git internals to save bandwidth
+          EXCLUDE: ".git/, .github/"
+          # 1. Create directory first
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
+          # 2. Run Docker Compose after sync
+          SCRIPT_AFTER: |
+            cd ${{ needs.prepare_context.outputs.pr_path }}
+            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
 
-      - name: Create directory on remote
+  # ------------------------------------------------------------------
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
+  # STAGE 3: DEPLOY STAGING
-
+  # ------------------------------------------------------------------
-  sync_repo_files:
+  deploy_staging:
-    name: Sync repository files
+    name: Deploy (Staging)
     runs-on: ubuntu-latest
-    needs: [create_remote_directory, prepare_deployment_vars]
+    if: github.ref == 'refs/heads/main'
-    if: |
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
-      || github.ref == 'refs/heads/main'
     steps:
-      - name: Checkout repository
+      - uses: actions/checkout@v4
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
-      - name: Sync files via scp
+      - name: Deploy via Rsync & Docker
-        uses: appleboy/scp-action@master
+        uses: easingthemes/ssh-deploy@v5.0.0
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ env.REMOTE_STAGING_PATH }}
+          EXCLUDE: ".git/, .github/"
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
+          SCRIPT_AFTER: |
+            cd ${{ env.REMOTE_STAGING_PATH }}
+            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
+
+  # ------------------------------------------------------------------
+  # STAGE 4: DEPLOY PRODUCTION
+  # ------------------------------------------------------------------
+  deploy_prod:
+    name: Deploy (Production)
+    runs-on: ubuntu-latest
+    needs: [deploy_staging]
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Deploy via Rsync & Docker
+        uses: easingthemes/ssh-deploy@v5.0.0
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ env.REMOTE_PROD_PATH }}
+          EXCLUDE: ".git/, .github/"
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ env.REMOTE_PROD_PATH }}
+          SCRIPT_AFTER: |
+            cd ${{ env.REMOTE_PROD_PATH }}
+            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans
+
+  # ------------------------------------------------------------------
+  # CLEANUP (Using appleboy/ssh-action for pure command execution)
+  # ------------------------------------------------------------------
+  cleanup:
+    name: Cleanup Preview
+    runs-on: ubuntu-latest
+    needs: [prepare_context]
+    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
+    steps:
+      - name: Remove Remote Environment
+        uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ env.SSH_HOST }}
           username: ${{ env.SSH_USER }}
           key: ${{ env.SSH_PRIVATE_KEY }}
           port: ${{ env.SSH_PORT }}
-          source: "./"
+          script: |
-          target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
-
+            if [ -d "$TARGET" ]; then
-      - name: Sync file via scp (staging)
+              cd "$TARGET"
-        if: github.ref == 'refs/heads/main'
+              docker compose down -v || true
-        uses: appleboy/scp-action@master
+              cd ..
-        with:
+              rm -rf "$TARGET"
-          host: ${{ env.SSH_HOST }}
+              echo "Cleanup successful"
-          username: ${{ env.SSH_USER }}
+            else
-          key: ${{ env.SSH_PRIVATE_KEY }}
+              echo "Directory not found, skipping."
-          port: ${{ env.SSH_PORT }}
+            fi
-          source: "./"
-          target: ${{ env.REMOTE_STAGING_PATH }}
-
-  run_docker_compose_dev:
-    name: Run docker-compose remotely (Dev)
-    runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
-
-  run_docker_compose_staging:
-    name: Run docker-compose remotely (Staging)
-    runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.ref == 'refs/heads/main')
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
-
-  run_docker_compose_prod:
-    name: Run docker-compose remotely (Prod)
-    runs-on: ubuntu-latest
-    needs: [sync_repo_files, prepare_deployment_vars]
-    if: |
-      (github.ref == 'refs/heads/main')
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
-
-  cleanup_mr_environment:
-    name: Cleanup MR environment
-    runs-on: ubuntu-latest
-    needs: prepare_deployment_vars
-    if: |
-      github.event_name == 'pull_request' && 
-      (github.event.action == 'closed' || github.event.pull_request.merged == true)
-    steps:
-      - name: Setup SSH
-        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
-        with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-
-      - name: Add host to known_hosts
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-            exit 1
-          }
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Run docker-compose down on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
-
-      - name: Delete deployment directory
-        run: |
-          ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"

docker-compose.prod.yaml

@@ -0,0 +1,9 @@
+services:
+  traefik:
+    networks:
+      - proxy
+      - legacy-nginx
+networks:
+  legacy-nginx:
+    name: proxy
+    external: true

docker-compose.yaml

@@ -6,7 +6,6 @@ services:
       - no-new-privileges:true
     networks:
       - proxy
-      - legacy-nginx
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -27,7 +26,7 @@ services:
       - "8080"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./data/letsencrypt:/letsencrypt"
+      - "letsencrypt:/letsencrypt"
       - "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
 
   whoami:
@@ -45,7 +44,4 @@ services:
       - traefik.http.routers.https.tls=true
       - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
-  proxy:
+  proxy:
-  legacy-nginx:
-    name: proxy
-    external: true