Merge pull request 'Build on Gitea, push to the Gitea registry' (#1) from ci/gitea-actions into main

Same move as the gateway repo -- build on the homelab runner, push to this
Gitea's registry, no deploy step -- with one difference that matters more here
than anywhere else.

Vite inlines import.meta.env at BUILD time. VITE_API_URL is therefore baked into
the bundle, and the GitHub build bakes https://api.t4t-gateway.com. Running that
image on the homelab would put a UI at t4tgw.ffaerber.duckdns.org that talks to
the VPS: a test signup would create a real account on production, and the two
instances would look identical while being the same instance. This build bakes
the homelab API, which is what makes running them side by side mean anything.

The app also falls back to the production URL when the variable is missing
(app/routes/*.tsx), so an unset build arg fails the same way silently. It is set
explicitly in the workflow env rather than left to a default.

.github/workflows is removed from this copy so Gitea does not try to run the
GitHub one; the GitHub repository keeps its own.

.gitea/workflows/docker.yml

@@ -0,0 +1,59 @@
+name: Docker
+# Builds the frontend for the HOMELAB instance and pushes it to this Gitea's
+# registry.
+#
+# Read the build args before changing anything: Vite inlines import.meta.env at
+# BUILD time, so VITE_API_URL is baked into the bundle and an image is tied to
+# one API. The GitHub build bakes https://api.t4t-gateway.com -- running that
+# image here would serve a UI at t4tgw.ffaerber.duckdns.org that talks to the
+# VPS, so a test signup would create a real account on production. This build
+# bakes the homelab API instead, which is the whole reason the two instances can
+# run side by side and mean anything.
+#
+# VITE_GOOGLE_CLIENT_ID comes from a repo secret; unset, Google sign-in is the
+# only thing that breaks, and the rest of the instance still exercises.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org
+
+jobs:
+  build:
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: |
+          set -eu
+          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend" >> "$GITHUB_ENV"
+          echo "SHA=$SHA" >> "$GITHUB_ENV"
+          docker build \
+            --build-arg VITE_API_URL="$HOMELAB_API_URL" \
+            --build-arg VITE_GOOGLE_CLIENT_ID="${{ secrets.VITE_GOOGLE_CLIENT_ID }}" \
+            --build-arg VITE_COMMIT_SHA=${{ github.sha }} \
+            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend:$SHA" .
+
+      - name: Push
+        if: github.event_name != 'pull_request'
+        run: |
+          set -eu
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
+          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
+          docker push "$IMAGE:$SHA"
+          docker push "$IMAGE:latest"
+          docker logout git.ffaerber.duckdns.org
+          {
+            echo "### Pushed"
+            echo
+            echo '```'
+            echo "$IMAGE:$SHA"
+            echo '```'
+            echo
+            echo "API baked in: $HOMELAB_API_URL"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docker-image.yml

@@ -1,54 +0,0 @@
-name: Docker Image CI
-
-on:
-  push:
-    branches: ['main', 'develop']
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.ref_name }}
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.sha }}
-          build-args: |
-            VITE_API_URL=https://api.t4t-gateway.com
-            VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }}
-            VITE_COMMIT_SHA=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: docker stack deploy
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          username: root
-          host: ${{ secrets.SSH_KNOWN_HOSTS }}
-          key: ${{ secrets.SSH_PRIV_KEY }}
-          script: |
-            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-            docker pull ghcr.io/token-for-token/hosted-gateway-frontend:main
-            docker stack deploy -c ~/devops/hostinger/prod-stack.yaml prod --with-registry-auth --resolve-image always
-            docker image prune -f --filter "until=24h"