improvement: docker infrastructure overhauled.

.gitea/workflows/registry-build-deploy.yml

@@ -0,0 +1,117 @@
+# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
+#
+# Repository Variables (Settings → Actions → Variables) — non-secret:
+#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
+#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
+#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
+#
+# Repository Secrets (Settings → Actions → Secrets):
+#   REGISTRY_USERNAME    Gitea username for docker login
+#   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
+#
+# Optional:
+#   STAGING_HTTP_PORT       host port for nginx (default 8088)
+#
+# Required for deploy job (absolute path on the runner host — forward slashes ok on Windows):
+#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
+#
+# Runner: self-hosted with Docker; Git Bash recommended on Windows (shell: bash).
+
+name: Registry — build, push, deploy
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-and-push:
+    runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Image tag and registry prefix
+        id: meta
+        run: |
+          echo "image_tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}" >> "$GITHUB_ENV"
+
+      - name: Log in to container registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push backend
+        run: |
+          TAG="${{ steps.meta.outputs.image_tag }}"
+          docker build \
+            -t "${REGISTRY_PREFIX}/dyolink-backend:${TAG}" \
+            -t "${REGISTRY_PREFIX}/dyolink-backend:latest" \
+            ./backend
+          docker push "${REGISTRY_PREFIX}/dyolink-backend:${TAG}"
+          docker push "${REGISTRY_PREFIX}/dyolink-backend:latest"
+
+      - name: Build and push frontend
+        env:
+          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
+        run: |
+          TAG="${{ steps.meta.outputs.image_tag }}"
+          docker build \
+            --build-arg NEXT_PUBLIC_API_URL="${PUBLIC_BASE_URL}/api" \
+            --build-arg NEXT_PUBLIC_APP_URL="${PUBLIC_BASE_URL}" \
+            --build-arg NEXT_PUBLIC_APP_NAME="Dyolink" \
+            -t "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}" \
+            -t "${REGISTRY_PREFIX}/dyolink-frontend:latest" \
+            ./frontend
+          docker push "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}"
+          docker push "${REGISTRY_PREFIX}/dyolink-frontend:latest"
+
+  deploy:
+    needs: build-and-push
+    runs-on: self-hosted
+    steps:
+      - name: Checkout infrastructure only
+        uses: https://gitea.com/actions/checkout@v4
+        with:
+          sparse-checkout: |
+            infrastructure
+          sparse-checkout-cone-mode: true
+
+      - name: Write deploy.registry.env and validate secrets path
+        run: |
+          SD='${{ vars.DEPLOY_SECRETS_DIR }}'
+          if [ -z "$SD" ]; then
+            echo "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
+            echo "where database.staging.env and backend.staging.env live (not in git)."
+            exit 1
+          fi
+          test -f "${SD}/database.staging.env" || { echo "Missing ${SD}/database.staging.env"; exit 1; }
+          test -f "${SD}/backend.staging.env" || { echo "Missing ${SD}/backend.staging.env"; exit 1; }
+          cd infrastructure
+          STAGING_PORT='${{ vars.STAGING_HTTP_PORT }}'
+          STAGING_PORT="${STAGING_PORT:-8088}"
+          {
+            echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
+            echo "IMAGE_TAG=${{ needs.build-and-push.outputs.image_tag }}"
+            echo "STAGING_HTTP_PORT=${STAGING_PORT}"
+            echo "DEPLOY_SECRETS_DIR=${SD}"
+          } > deploy.registry.env
+
+      - name: Log in to container registry (for pull)
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Pull and start stack
+        run: |
+          set -e
+          cd infrastructure
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d