deploy

.gitea/workflows/deploy.yml

@@ -6,8 +6,6 @@ on:
 
 jobs:
   build-and-deploy:
-    # ────────────────────────────────────────────────
-    # WICHTIG: Kein "docker" mehr – sondern eines der neuen Labels
     runs-on: docker
 
     steps:
@@ -72,11 +70,10 @@ jobs:
           echo "  Platform: linux/arm64"
           echo "  Target: registry.infra.mintel.me/mintel/klz-cables.com:latest"
           echo ""
-          echo "📦 Build Arguments:"
+          echo "📦 Build Arguments (NEXT_PUBLIC_* only - baked into client bundle):"
+          echo "  • NEXT_PUBLIC_BASE_URL: ${{ secrets.NEXT_PUBLIC_BASE_URL != '' && '***' || 'NOT SET' }}"
           echo "  • NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID != '' && '***' || 'NOT SET' }}"
           echo "  • NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${{ secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL != '' && '***' || 'NOT SET' }}"
-          echo "  • SENTRY_DSN: ${{ secrets.SENTRY_DSN != '' && '***' || 'NOT SET' }}"
-          echo "  • NEXT_PUBLIC_BASE_URL: ${{ secrets.NEXT_PUBLIC_BASE_URL != '' && '***' || 'NOT SET' }}"
           echo ""
           echo "⏱️ Build started at: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
           echo ""
@@ -86,10 +83,9 @@ jobs:
           docker buildx build \
             --pull \
             --platform linux/arm64 \
+            --build-arg NEXT_PUBLIC_BASE_URL="${{ secrets.NEXT_PUBLIC_BASE_URL }}" \
             --build-arg NEXT_PUBLIC_UMAMI_WEBSITE_ID="${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID }}" \
             --build-arg NEXT_PUBLIC_UMAMI_SCRIPT_URL="${{ secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL }}" \
-            --build-arg SENTRY_DSN="${{ secrets.SENTRY_DSN }}" \
-            --build-arg NEXT_PUBLIC_BASE_URL="${{ secrets.NEXT_PUBLIC_BASE_URL }}" \
             -t registry.infra.mintel.me/mintel/klz-cables.com:latest \
             --push .
           
@@ -141,36 +137,112 @@ jobs:
           fi
           echo ""
           
+          # Create .env file content
+          echo "📝 Preparing environment configuration..."
+          cat > /tmp/klz-cables.env << EOF
+          # ============================================================================
+          # KLZ Cables - Production Environment Configuration
+          # ============================================================================
+          # Auto-generated by CI/CD workflow
+          # DO NOT EDIT MANUALLY - Changes will be overwritten on next deployment
+          # ============================================================================
+          
+          # Application
+          NODE_ENV=production
+          NEXT_PUBLIC_BASE_URL=${{ secrets.NEXT_PUBLIC_BASE_URL }}
+          
+          # Analytics (Umami)
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID=${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID }}
+          NEXT_PUBLIC_UMAMI_SCRIPT_URL=${{ secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL }}
+          
+          # Error Tracking (GlitchTip/Sentry)
+          SENTRY_DSN=${{ secrets.SENTRY_DSN }}
+          
+          # Email Configuration (Mailgun)
+          MAIL_HOST=${{ secrets.MAIL_HOST }}
+          MAIL_PORT=${{ secrets.MAIL_PORT }}
+          MAIL_USERNAME=${{ secrets.MAIL_USERNAME }}
+          MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
+          MAIL_FROM=${{ secrets.MAIL_FROM }}
+          MAIL_RECIPIENTS=${{ secrets.MAIL_RECIPIENTS }}
+          
+          # Redis Cache
+          REDIS_URL=${{ secrets.REDIS_URL }}
+          REDIS_KEY_PREFIX=${{ secrets.REDIS_KEY_PREFIX }}
+          
+          # Varnish Cache Size
+          VARNISH_CACHE_SIZE=256m
+          EOF
+          
+          echo "✅ Environment file prepared"
+          echo ""
+          
           # Execute deployment commands with detailed logging
-          echo "📡 Connecting to server and executing deployment commands..."
+          echo "📡 Connecting to server and executing deployment..."
           echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
           echo ""
           
-          # SSH as root and use sudo to run deployment script as deploy user
-          # This works around the broken SSH output issue with deploy user
+          # Copy .env file to server
+          echo "📤 Uploading environment configuration..."
+          scp -o StrictHostKeyChecking=accept-new \
+              -o ServerAliveInterval=30 \
+              -o ServerAliveCountMax=3 \
+              -o ConnectTimeout=10 \
+              /tmp/klz-cables.env \
+              root@alpha.mintel.me:/home/deploy/sites/klz-cables.com/.env
+          
+          if [ $? -eq 0 ]; then
+            echo "✅ Environment file uploaded successfully"
+          else
+            echo "❌ Failed to upload environment file"
+            exit 1
+          fi
+          echo ""
+          
+          # SSH to server and run deployment
+          echo "🚀 Executing deployment on server..."
           ssh -o StrictHostKeyChecking=accept-new \
               -o ServerAliveInterval=30 \
               -o ServerAliveCountMax=3 \
               -o ConnectTimeout=10 \
-              root@alpha.mintel.me \
-              "MAIL_FROM='${{ secrets.MAIL_FROM }}' \
-               MAIL_HOST='${{ secrets.MAIL_HOST }}' \
-               MAIL_PASSWORD='${{ secrets.MAIL_PASSWORD }}' \
-               MAIL_PORT='${{ secrets.MAIL_PORT }}' \
-               MAIL_RECIPIENTS='${{ secrets.MAIL_RECIPIENTS }}' \
-               MAIL_USERNAME='${{ secrets.MAIL_USERNAME }}' \
-               NEXT_PUBLIC_BASE_URL='${{ secrets.NEXT_PUBLIC_BASE_URL }}' \
-               NEXT_PUBLIC_UMAMI_WEBSITE_ID='${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID }}' \
-               NEXT_PUBLIC_UMAMI_SCRIPT_URL='${{ secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL }}' \
-               NODE_ENV='${{ secrets.NODE_ENV }}' \
-               SENTRY_DSN='${{ secrets.SENTRY_DSN }}' \
-               REDIS_URL='${{ secrets.REDIS_URL }}' \
-               REDIS_KEY_PREFIX='${{ secrets.REDIS_KEY_PREFIX }}' \
-               /home/deploy/deploy.sh"
+              root@alpha.mintel.me bash << EOF
+          set -e
+          
+          PROJECT_DIR="/home/deploy/sites/klz-cables.com"
+          cd "\$PROJECT_DIR"
+          
+          echo "🔒 Securing environment file..."
+          chmod 600 .env
+          chown deploy:deploy .env
+          
+          echo "🔐 Logging into Docker registry..."
+          echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          
+          echo "🔄 Pulling latest image..."
+          docker pull registry.infra.mintel.me/mintel/klz-cables.com:latest
+          
+          echo "🔄 Stopping existing containers..."
+          docker-compose down
+          
+          echo "🚀 Starting new containers..."
+          docker-compose up -d
+          
+          echo "⏳ Waiting for services to be healthy..."
+          sleep 10
+          
+          echo "🔍 Checking service status..."
+          docker-compose ps
+          
+          echo ""
+          echo "✅ Deployment complete!"
+          EOF
           
           DEPLOY_EXIT_CODE=$?
           echo ""
           
+          # Clean up temporary env file
+          rm -f /tmp/klz-cables.env
+          
           if [ $DEPLOY_EXIT_CODE -eq 0 ]; then
             echo "✅ Deployment completed successfully at: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
           else
@@ -181,6 +253,7 @@ jobs:
             echo "  • Verify SSH key permissions on server"
             echo "  • Check disk space on target server"
             echo "  • Review docker compose configuration"
+            echo "  • Verify all required secrets are set in Gitea"
             exit $DEPLOY_EXIT_CODE
           fi
           echo ""
@@ -208,6 +281,8 @@ jobs:
           echo "  • All secrets are masked (*** ) in logs"
           echo "  • SSH keys are created with 600 permissions"
           echo "  • Passwords are never displayed in plain text"
+          echo "  • .env file is auto-generated from Gitea secrets"
+          echo "  • .env file has 600 permissions on server"
           echo ""
           echo "╔══════════════════════════════════════════════════════════════════════════════╗"
           if [ "${{ job.status }}" == "success" ]; then