chore: overhaul infrastructure and integrate @mintel packages

- Restructure to pnpm monorepo (site moved to apps/web)
- Integrate @mintel/tsconfig, @mintel/eslint-config, @mintel/husky-config
- Implement Docker service architecture (Varnish, Directus, Gatekeeper)
- Setup environment-aware Gitea Actions deployment

.gitea/workflows/deploy.yml

@@ -1,146 +1,201 @@
-name: Build & Deploy Mintel Blog
+name: Build & Deploy Mintel.me
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ (github.ref_type == 'tag' && !contains(github.ref_name, '-')) && 'prod' || (github.ref_type == 'tag' && 'staging' || 'testing') }}
+  cancel-in-progress: true
 
 jobs:
-  build-and-deploy:
+  prepare:
+    name: 🔍 Prepare Environment
     runs-on: docker
-
+    outputs:
+      target:           ${{ steps.determine.outputs.target }}
+      image_tag:        ${{ steps.determine.outputs.image_tag }}
+      env_file:         ${{ steps.determine.outputs.env_file }}
+      traefik_host:     ${{ steps.determine.outputs.traefik_host }}
+      next_public_base_url: ${{ steps.determine.outputs.next_public_base_url }}
+      directus_url:     ${{ steps.determine.outputs.directus_url }}
+      directus_host:    ${{ steps.determine.outputs.directus_host }}
+      project_name:     ${{ steps.determine.outputs.project_name }}
+      is_prod:          ${{ steps.determine.outputs.is_prod }}
+      gotify_title:     ${{ steps.determine.outputs.gotify_title }}
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
-      - name: 📋 Log Workflow Start
-        run: |
-          echo "🚀 Starting deployment for ${{ github.repository }} (${{ github.ref }})"
-          echo "  • Commit: ${{ github.sha }}"
-          echo "  • Timestamp: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
 
+      - name: 🔍 Determine Environment
+        id: determine
+        shell: bash
+        run: |
+          TAG="${{ github.ref_name }}"
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-9)
+          
+          if [[ "${{ github.ref_type }}" == "branch" && "$TAG" == "main" ]]; then
+            TARGET="testing"
+            IMAGE_TAG="main-${SHORT_SHA}"
+            ENV_FILE=".env.testing"
+            TRAEFIK_HOST="testing.mintel.me"
+            NEXT_PUBLIC_BASE_URL="https://testing.mintel.me"
+            DIRECTUS_URL="https://cms.testing.mintel.me"
+            DIRECTUS_HOST="cms.testing.mintel.me"
+            PROJECT_NAME="mintel-me-testing"
+            IS_PROD="false"
+            GOTIFY_TITLE="🧪 Testing-Deploy"
+          elif [[ "${{ github.ref_type }}" == "tag" ]]; then
+            if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              TARGET="production"
+              IMAGE_TAG="$TAG"
+              ENV_FILE=".env.prod"
+              TRAEFIK_HOST="mintel.me, www.mintel.me"
+              NEXT_PUBLIC_BASE_URL="https://mintel.me"
+              DIRECTUS_URL="https://cms.mintel.me"
+              DIRECTUS_HOST="cms.mintel.me"
+              PROJECT_NAME="mintel-me-prod"
+              IS_PROD="true"
+              GOTIFY_TITLE="🚀 Production-Release"
+            else
+              TARGET="staging"
+              IMAGE_TAG="$TAG"
+              ENV_FILE=".env.staging"
+              TRAEFIK_HOST="staging.mintel.me"
+              NEXT_PUBLIC_BASE_URL="https://staging.mintel.me"
+              DIRECTUS_URL="https://cms.staging.mintel.me"
+              DIRECTUS_HOST="cms.staging.mintel.me"
+              PROJECT_NAME="mintel-me-staging"
+              IS_PROD="false"
+              GOTIFY_TITLE="🧪 Staging-Deploy"
+            fi
+          else
+            echo "Skipping deploy for unknown ref type"
+            exit 1
+          fi
+
+          echo "target=$TARGET" >> $GITHUB_OUTPUT
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+          echo "env_file=$ENV_FILE" >> $GITHUB_OUTPUT
+          echo "traefik_host=$TRAEFIK_HOST" >> $GITHUB_OUTPUT
+          echo "next_public_base_url=$NEXT_PUBLIC_BASE_URL" >> $GITHUB_OUTPUT
+          echo "directus_url=$DIRECTUS_URL" >> $GITHUB_OUTPUT
+          echo "directus_host=$DIRECTUS_HOST" >> $GITHUB_OUTPUT
+          echo "project_name=$PROJECT_NAME" >> $GITHUB_OUTPUT
+          echo "is_prod=$IS_PROD" >> $GITHUB_OUTPUT
+          echo "gotify_title=$GOTIFY_TITLE" >> $GITHUB_OUTPUT
+
+  build:
+    name: 🏗️ Build & Push
+    needs: prepare
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: 🔐 Login to private registry
+      - name: 🐳 Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: 🔐 Registry Login
         run: |
-          echo "🔐 Authenticating with registry.infra.mintel.me..."
           echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      - name: 🏗️ Build Docker image
+      - name: 🏗️ Build & Push
+        env:
+          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
+          TARGET:    ${{ needs.prepare.outputs.target }}
+          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_base_url }}
+          DIRECTUS_URL:         ${{ needs.prepare.outputs.directus_url }}
         run: |
-          echo "🏗️ Building Docker image (linux/arm64)..."
           docker buildx build \
             --pull \
             --platform linux/arm64 \
-            --build-arg NEXT_PUBLIC_ANALYTICS_PROVIDER="${{ secrets.NEXT_PUBLIC_ANALYTICS_PROVIDER }}" \
-            --build-arg NEXT_PUBLIC_UMAMI_WEBSITE_ID="${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID }}" \
-            --build-arg NEXT_PUBLIC_UMAMI_HOST_URL="${{ secrets.NEXT_PUBLIC_UMAMI_HOST_URL }}" \
-            --build-arg NEXT_PUBLIC_PLAUSIBLE_DOMAIN="${{ secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN }}" \
-            --build-arg NEXT_PUBLIC_PLAUSIBLE_SCRIPT_URL="${{ secrets.NEXT_PUBLIC_PLAUSIBLE_SCRIPT_URL }}" \
-            --build-arg NEXT_PUBLIC_GLITCHTIP_DSN="${{ secrets.NEXT_PUBLIC_GLITCHTIP_DSN }}" \
-            -t registry.infra.mintel.me/mintel/mintel.me:latest \
-            --push -f docker/Dockerfile .
+            --build-arg NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL" \
+            --build-arg NEXT_PUBLIC_TARGET="$TARGET" \
+            --build-arg DIRECTUS_URL="$DIRECTUS_URL" \
+            --secret id=NPM_TOKEN,env=NPM_TOKEN \
+            -t registry.infra.mintel.me/mintel/mintel.me:$IMAGE_TAG \
+            --push .
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: 🚀 Deploy to production server
+  deploy:
+    name: 🚀 Deploy
+    needs: [prepare, build]
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: 🚀 Deploy via SSH
+        env:
+          TARGET:       ${{ needs.prepare.outputs.target }}
+          IMAGE_TAG:    ${{ needs.prepare.outputs.image_tag }}
+          ENV_FILE:     ${{ needs.prepare.outputs.env_file }}
+          PROJECT_NAME: ${{ needs.prepare.outputs.project_name }}
+          AUTH_MIDDLEWARE: ${{ needs.prepare.outputs.is_prod == 'true' && 'compress' || format('{0}-auth,compress', needs.prepare.outputs.project_name) }}
         run: |
-          echo "🚀 Deploying to alpha.mintel.me..."
-          
-          # Setup SSH
           mkdir -p ~/.ssh
           echo "${{ secrets.ALPHA_SSH_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H alpha.mintel.me >> ~/.ssh/known_hosts 2>/dev/null
+
+          # Create .env on the fly
+          cat > .env.tmp << EOF
+          # Generated by CI
+          NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_base_url }}
+          NEXT_PUBLIC_TARGET=$TARGET
+          DIRECTUS_URL=${{ needs.prepare.outputs.directus_url }}
+          DIRECTUS_HOST=${{ needs.prepare.outputs.directus_host }}
+          TRAEFIK_HOST=${{ needs.prepare.outputs.traefik_host }}
+          IMAGE_TAG=$IMAGE_TAG
+          PROJECT_NAME=$PROJECT_NAME
+          AUTH_MIDDLEWARE=$AUTH_MIDDLEWARE
           
-          # Create .env file content
-          cat > /tmp/mintel.me.env << EOF
-          # ============================================================================
-          # Mintel Blog - Production Environment Configuration
-          # ============================================================================
-          # Auto-generated by CI/CD workflow
-          # ============================================================================
-          
-          # Application
-          NODE_ENV=production
-          DOMAIN=mintel.me
-          ADMIN_EMAIL=${{ secrets.ADMIN_EMAIL }}
-          
-          # Analytics
-          NEXT_PUBLIC_ANALYTICS_PROVIDER=${{ secrets.NEXT_PUBLIC_ANALYTICS_PROVIDER }}
-          NEXT_PUBLIC_UMAMI_WEBSITE_ID=${{ secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID }}
-          NEXT_PUBLIC_UMAMI_HOST_URL=${{ secrets.NEXT_PUBLIC_UMAMI_HOST_URL }}
-          NEXT_PUBLIC_PLAUSIBLE_DOMAIN=${{ secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN }}
-          NEXT_PUBLIC_PLAUSIBLE_SCRIPT_URL=${{ secrets.NEXT_PUBLIC_PLAUSIBLE_SCRIPT_URL }}
-          
-          # Error Tracking (GlitchTip/Sentry)
-          NEXT_PUBLIC_GLITCHTIP_DSN=${{ secrets.NEXT_PUBLIC_GLITCHTIP_DSN }}
-          
-          # Redis
-          REDIS_URL=redis://redis:6379
-          
+          # Secrets
+          DIRECTUS_KEY=${{ secrets.DIRECTUS_KEY }}
+          DIRECTUS_SECRET=${{ secrets.DIRECTUS_SECRET }}
+          DIRECTUS_DB_NAME=${{ secrets.DIRECTUS_DB_NAME || 'directus' }}
+          DIRECTUS_DB_USER=${{ secrets.DIRECTUS_DB_USER || 'directus' }}
+          DIRECTUS_DB_PASSWORD=${{ secrets.DIRECTUS_DB_PASSWORD }}
           EOF
-          
-          # Upload .env and deploy
-          scp -o StrictHostKeyChecking=accept-new /tmp/mintel.me.env root@alpha.mintel.me:/home/deploy/sites/mintel.me/.env
-          
-          ssh -o StrictHostKeyChecking=accept-new root@alpha.mintel.me bash << EOF
-          set -e
-          cd /home/deploy/sites/mintel.me
-          
-          chmod 600 .env
-          chown deploy:deploy .env
-          
-          echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-          docker pull registry.infra.mintel.me/mintel/mintel.me:latest
-          
-          docker-compose down
-          
-          echo "🚀 Starting containers..."
-          docker-compose up -d
-          
-          echo "⏳ Giving the app a few seconds to warm up..."
-          sleep 10
-          
-          echo "🔍 Checking container status..."
-          docker-compose ps
-          
-          if ! docker-compose ps | grep -q "Up"; then
-            echo "❌ Container failed to start"
-            docker-compose logs --tail=100
-            exit 1
-          fi
 
-          echo "✅ Deployment complete!"
+          scp .env.tmp root@alpha.mintel.me:/home/deploy/sites/mintel.me/$ENV_FILE
+          scp docker-compose.yml root@alpha.mintel.me:/home/deploy/sites/mintel.me/docker-compose.yml
+          scp -r varnish root@alpha.mintel.me:/home/deploy/sites/mintel.me/
+
+          ssh root@alpha.mintel.me IMAGE_TAG="$IMAGE_TAG" ENV_FILE="$ENV_FILE" PROJECT_NAME="$PROJECT_NAME" bash << 'EOF'
+            cd /home/deploy/sites/mintel.me
+            echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            docker compose -p "$PROJECT_NAME" --env-file "$ENV_FILE" pull
+            docker compose -p "$PROJECT_NAME" --env-file "$ENV_FILE" up -d --remove-orphans
+            docker system prune -f --filter "until=24h"
           EOF
-          
-          rm -f /tmp/mintel.me.env
 
-      - name: 📊 Workflow Summary
-        if: always()
+  notifications:
+    name: 🔔 Notifications
+    needs: [prepare, deploy]
+    if: always()
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
+      - name: 🔔 Gotify
         run: |
-          echo "📊 Status: ${{ job.status }}"
-          echo "🎯 Target: alpha.mintel.me"
-
-      - name: 🔔 Gotify Notification (Success)
-        if: success()
-        run: |
-          echo "Sending success notification to Gotify..."
-          curl -k -s -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
-            -F "title=✅ Deployment Success: ${{ github.repository }}" \
-            -F "message=The deployment of ${{ github.repository }} (branch: ${{ github.ref }}) was successful.
-            
-            Commit: ${{ github.sha }}
-            Actor: ${{ github.actor }}
-            Run ID: ${{ github.run_id }}" \
-            -F "priority=5"
-
-      - name: 🔔 Gotify Notification (Failure)
-        if: failure()
-        run: |
-          echo "Sending failure notification to Gotify..."
-          curl -k -s -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
-            -F "title=❌ Deployment Failed: ${{ github.repository }}" \
-            -F "message=The deployment of ${{ github.repository }} (branch: ${{ github.ref }}) failed!
-            
-            Commit: ${{ github.sha }}
-            Actor: ${{ github.actor }}
-            Run ID: ${{ github.run_id }}
-            
-            Please check the logs for details." \
-            -F "priority=8"
+          STATUS="${{ needs.deploy.result == 'success' && '✅' || '❌' }}"
+          curl -s -k -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
+            -F "title=$STATUS ${{ needs.prepare.outputs.gotify_title }}" \
+            -F "message=Deploy to **${{ needs.prepare.outputs.target }}** ${{ needs.deploy.result }}.\nVersion: ${{ needs.prepare.outputs.image_tag }}" \
+            -F "priority=5" || true