From 3472d06a709356d566bf50bf5b6c4dae8ef2e490 Mon Sep 17 00:00:00 2001
From: github-ops <github-ops@rmcp.itexp.me>
Date: Sun, 21 Jun 2026 15:43:35 +0000
Subject: [PATCH] Restore Gitea deployment workflow

---
 .gitea/workflows/deploy.yml  | 237 +++++++++++++++++++++++++++++++++++
 .gitea/workflows/release.yml | 100 +++++++++++++++
 scripts/load-openbao-env.sh  |  86 +++++++++++++
 3 files changed, 423 insertions(+)
 create mode 100644 .gitea/workflows/deploy.yml
 create mode 100644 .gitea/workflows/release.yml
 create mode 100755 scripts/load-openbao-env.sh

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..5ec3484
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,237 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.itexp.me
+  IMAGE_TAG: ${{ gitea.sha }}
+  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
+  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
+  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
+  OPENBAO_ENV_FILE: .openbao-env
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          docker --version
+          command -v bao
+          bao version
+
+      - name: Load deployment secrets from OpenBao
+        env:
+          BAO_ADDR: ${{ secrets.BAO_ADDR }}
+          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
+          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
+          OPENBAO_APP: crank
+        run: scripts/load-openbao-env.sh
+
+      - name: Login to registry
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
+            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
+
+      - name: Build and push images
+        run: |
+          docker build -f apps/admin-api/Dockerfile \
+            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.ADMIN_API_IMAGE }}:main' \
+            .
+          docker build -f apps/mcp-server/Dockerfile \
+            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.MCP_SERVER_IMAGE }}:main' \
+            .
+          docker build -f apps/ui/Dockerfile \
+            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.UI_IMAGE }}:main' \
+            .
+          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.ADMIN_API_IMAGE }}:main'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:main'
+          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.UI_IMAGE }}:main'
+
+      - name: Configure SSH key
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+      - name: Configure known hosts
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          if [ -n "${DEPLOY_KNOWN_HOSTS:-}" ]; then
+            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          else
+            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > ~/.ssh/known_hosts
+          fi
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Sync deployment files to server
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "mkdir -p '$DEPLOY_PATH'"
+          rsync -az -e "ssh -p $DEPLOY_PORT" deploy/community/docker-compose.yml \
+            "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml"
+
+      - name: Write environment file
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          tmp_env="$(mktemp)"
+          append_if_set() {
+            if [ -n "$2" ]; then
+              printf '%s=%s\n' "$1" "$2" >> "$tmp_env"
+            fi
+          }
+          : > "$tmp_env"
+          append_if_set POSTGRES_DB "$POSTGRES_DB"
+          append_if_set POSTGRES_USER "$POSTGRES_USER"
+          append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+          append_if_set POSTGRES_HOST "$POSTGRES_HOST"
+          if [ -n "${POSTGRES_PORT:-}" ]; then
+            append_if_set POSTGRES_PORT "$POSTGRES_PORT"
+          elif [ -n "${PGBOUNCER_PORT:-}" ]; then
+            append_if_set POSTGRES_PORT "$PGBOUNCER_PORT"
+          fi
+          append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
+          append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND"
+          append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
+          append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
+          append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
+          append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL"
+          append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY"
+          append_if_set CRANK_BASE_URL "$CRANK_BASE_URL"
+          append_if_set CRANK_CACHE_BACKEND "$CRANK_CACHE_BACKEND"
+          append_if_set CRANK_CACHE_URL "$CRANK_CACHE_URL"
+          append_if_set CRANK_CACHE_DEFAULT_TTL_MS "$CRANK_CACHE_DEFAULT_TTL_MS"
+          append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET"
+          append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER"
+          append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME"
+          append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED"
+          {
+            printf 'COMPOSE_PROJECT_NAME=community\n'
+            printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' '${{ env.ADMIN_API_IMAGE }}' '${{ env.IMAGE_TAG }}'
+            printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' '${{ env.MCP_SERVER_IMAGE }}' '${{ env.IMAGE_TAG }}'
+            printf 'CRANK_UI_IMAGE=%s:%s\n' '${{ env.UI_IMAGE }}' '${{ env.IMAGE_TAG }}'
+          } >> "$tmp_env"
+          cat "$tmp_env" | ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "mkdir -p '$DEPLOY_PATH' && cat > '$DEPLOY_PATH/.env'"
+          rm -f "$tmp_env"
+
+      - name: Validate required environment variables
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
+            set -e
+            cd '$DEPLOY_PATH'
+            required_vars='
+              POSTGRES_HOST
+              POSTGRES_PORT
+              POSTGRES_DB
+              POSTGRES_USER
+              POSTGRES_PASSWORD
+              CRANK_MASTER_KEY
+              CRANK_SESSION_SECRET
+              CRANK_PASSWORD_PEPPER
+              CRANK_BOOTSTRAP_ADMIN_EMAIL
+              CRANK_BOOTSTRAP_ADMIN_PASSWORD
+              CRANK_BASE_URL
+            '
+            for var in \$required_vars; do
+              value=\$(grep -E \"^\${var}=\" .env | tail -n1 | cut -d= -f2- || true)
+              if [ -z \"\$value\" ]; then
+                echo \"missing required env: \$var\" >&2
+                exit 1
+              fi
+            done
+          "
+
+      - name: Deploy with Docker Compose
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
+            set -e
+            cd '$DEPLOY_PATH'
+            compose_profiles=''
+            cache_backend=\$(grep -E '^CRANK_CACHE_BACKEND=' .env | tail -n1 | cut -d= -f2- || true)
+            if [ \"\$cache_backend\" = 'valkey' ] || [ \"\$cache_backend\" = 'redis' ]; then
+              compose_profiles='--profile cache'
+            fi
+            echo '$DEPLOY_REGISTRY_TOKEN' | docker login '${{ env.REGISTRY }}' -u '$DEPLOY_REGISTRY_USER' --password-stdin
+            docker compose \$compose_profiles config -q
+            docker compose \$compose_profiles pull
+            docker compose \$compose_profiles down --remove-orphans
+            for container in \
+              crank-ui-1 \
+              crank-admin-api-1 \
+              crank-mcp-server-1 \
+              crank-postgres-1 \
+              crank-valkey-1 \
+              crank-community-ui-1 \
+              crank-community-admin-api-1 \
+              crank-community-mcp-server-1 \
+              crank-community-postgres-1 \
+              crank-community-valkey-1; do
+              if docker ps -a --format '{{.Names}}' | grep -Fx \"\$container\" >/dev/null; then
+                docker rm -f \"\$container\"
+              fi
+            done
+            echo 'Docker containers before freeing required ports:'
+            docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Ports}}'
+            for port in 3000 3001 3002; do
+              container_ids=\$(docker ps -aq --filter \"publish=\$port\")
+              if [ -n \"\$container_ids\" ]; then
+                echo \"Removing containers publishing port \$port\"
+                docker inspect --format '{{.Name}} {{json .NetworkSettings.Ports}}' \$container_ids || true
+                docker rm -f \$container_ids
+              fi
+            done
+            if command -v ss >/dev/null 2>&1; then
+              ss -ltnp '( sport = :3000 or sport = :3001 or sport = :3002 )' || true
+            fi
+            docker compose \$compose_profiles up -d --remove-orphans
+          "
+
+      - name: Verify health endpoints
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
+            set -e
+            cd '$DEPLOY_PATH'
+            for attempt in \$(seq 1 30); do
+              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
+                exit 0
+              fi
+              sleep 2
+            done
+            echo 'deployment health verification failed' >&2
+            docker compose ps >&2
+            exit 1
+          "
+
+      - name: Run authenticated product smoke
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          CRANK_STAGING_ADMIN_EMAIL="$CRANK_BOOTSTRAP_ADMIN_EMAIL" \
+          CRANK_STAGING_ADMIN_PASSWORD="$CRANK_BOOTSTRAP_ADMIN_PASSWORD" \
+          scripts/authenticated-product-smoke.sh "$CRANK_BASE_URL"
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..e82c12d
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,100 @@
+name: Community Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.itexp.me
+  IMAGE_TAG: ${{ gitea.ref_name }}
+  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
+  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
+  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
+  OPENBAO_ENV_FILE: .openbao-env
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          rustc --version
+          cargo --version
+          node --version
+          npm --version
+          docker --version
+          command -v bao
+          bao version
+
+      - name: Build release binaries
+        run: cargo build --release -p admin-api -p mcp-server
+
+      - name: Install UI dependencies
+        working-directory: apps/ui
+        run: npm ci
+
+      - name: Build UI dist
+        working-directory: apps/ui
+        run: npm run build
+
+      - name: Package release artifacts
+        run: |
+          mkdir -p dist/release
+          cp target/release/admin-api dist/release/admin-api
+          cp target/release/mcp-server dist/release/mcp-server
+          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
+          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
+          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
+          sha256sum \
+            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
+            > dist/crank-community-${IMAGE_TAG}-checksums.txt
+
+      - name: Generate SBOM
+        run: |
+          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
+            dir:/workspace -o spdx-json \
+            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json
+
+      - name: Load deployment secrets from OpenBao
+        env:
+          BAO_ADDR: ${{ secrets.BAO_ADDR }}
+          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
+          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
+          OPENBAO_APP: crank
+        run: scripts/load-openbao-env.sh
+
+      - name: Login to registry
+        run: |
+          . "$OPENBAO_ENV_FILE"
+          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
+            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
+
+      - name: Build and push release images
+        run: |
+          docker build -f apps/admin-api/Dockerfile \
+            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.ADMIN_API_IMAGE }}:latest' .
+          docker build -f apps/mcp-server/Dockerfile \
+            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.MCP_SERVER_IMAGE }}:latest' .
+          docker build -f apps/ui/Dockerfile \
+            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.UI_IMAGE }}:latest' .
+          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.ADMIN_API_IMAGE }}:latest'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:latest'
+          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.UI_IMAGE }}:latest'
+
+      - name: Show release bundle summary
+        run: |
+          ls -lh dist
diff --git a/scripts/load-openbao-env.sh b/scripts/load-openbao-env.sh
new file mode 100755
index 0000000..6376942
--- /dev/null
+++ b/scripts/load-openbao-env.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${BAO_ADDR:?BAO_ADDR is required}"
+: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
+: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
+: "${OPENBAO_APP:?OPENBAO_APP is required}"
+
+output="${OPENBAO_ENV_FILE:-.openbao-env}"
+payload="$(mktemp)"
+merged="$(mktemp)"
+trap 'rm -f "$payload" "$merged"' EXIT
+
+export BAO_ADDR
+BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
+export BAO_TOKEN
+
+printf '{}\n' > "$merged"
+
+merge_secret() {
+  local path="$1"
+
+  bao kv get -mount=ci -format=json "$path" > "$payload"
+
+  python3 - "$payload" "$merged" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+merged_path = Path(sys.argv[2])
+merged = json.loads(merged_path.read_text(encoding="utf-8"))
+
+data = payload.get("data", {})
+if isinstance(data, dict) and isinstance(data.get("data"), dict):
+    data = data["data"]
+
+if not isinstance(data, dict):
+    raise SystemExit("OpenBao response does not contain an object secret payload")
+
+merged.update({key: value for key, value in data.items() if value is not None})
+merged_path.write_text(json.dumps(merged), encoding="utf-8")
+PY
+}
+
+merge_secret "shared/registry"
+merge_secret "shared/deploy-ssh"
+merge_secret "projects/${OPENBAO_APP}/deploy"
+merge_secret "projects/${OPENBAO_APP}/runtime"
+
+python3 - "$merged" "$output" <<'PY'
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+output_path = Path(sys.argv[2])
+
+if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
+    data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]
+
+if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
+    data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]
+
+name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+lines = [
+    "# Generated by scripts/load-openbao-env.sh",
+    "# Do not commit this file.",
+]
+
+for key in sorted(data):
+    if not name_re.match(key):
+        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
+    value = data[key]
+    if isinstance(value, bool):
+        value = "true" if value else "false"
+    elif not isinstance(value, str):
+        value = str(value)
+    lines.append(f"export {key}={shlex.quote(value)}")
+
+output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+output_path.chmod(0o600)
+print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
+PY