From 67b00b8848b7535322733ff2f11ba039c1d076cd Mon Sep 17 00:00:00 2001
From: Felix Faerber <ffaerber@gmail.com>
Date: Tue, 15 Sep 2026 12:30:27 +0300
Subject: [PATCH] build on Gitea, against the homelab API

Same move as the gateway repo -- build on the homelab runner, push to this
Gitea's registry, no deploy step -- with one difference that matters more here
than anywhere else.

Vite inlines import.meta.env at BUILD time. VITE_API_URL is therefore baked into
the bundle, and the GitHub build bakes https://api.t4t-gateway.com. Running that
image on the homelab would put a UI at t4tgw.ffaerber.duckdns.org that talks to
the VPS: a test signup would create a real account on production, and the two
instances would look identical while being the same instance. This build bakes
the homelab API, which is what makes running them side by side mean anything.

The app also falls back to the production URL when the variable is missing
(app/routes/*.tsx), so an unset build arg fails the same way silently. It is set
explicitly in the workflow env rather than left to a default.

.github/workflows is removed from this copy so Gitea does not try to run the
GitHub one; the GitHub repository keeps its own.
---
 .gitea/workflows/docker.yml        | 59 ++++++++++++++++++++++++++++++
 .github/workflows/docker-image.yml | 54 ---------------------------
 2 files changed, 59 insertions(+), 54 deletions(-)
 create mode 100644 .gitea/workflows/docker.yml
 delete mode 100644 .github/workflows/docker-image.yml

diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
new file mode 100644
index 0000000..753b9b0
--- /dev/null
+++ b/.gitea/workflows/docker.yml
@@ -0,0 +1,59 @@
+name: Docker
+# Builds the frontend for the HOMELAB instance and pushes it to this Gitea's
+# registry.
+#
+# Read the build args before changing anything: Vite inlines import.meta.env at
+# BUILD time, so VITE_API_URL is baked into the bundle and an image is tied to
+# one API. The GitHub build bakes https://api.t4t-gateway.com -- running that
+# image here would serve a UI at t4tgw.ffaerber.duckdns.org that talks to the
+# VPS, so a test signup would create a real account on production. This build
+# bakes the homelab API instead, which is the whole reason the two instances can
+# run side by side and mean anything.
+#
+# VITE_GOOGLE_CLIENT_ID comes from a repo secret; unset, Google sign-in is the
+# only thing that breaks, and the rest of the instance still exercises.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org
+
+jobs:
+  build:
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: |
+          set -eu
+          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend" >> "$GITHUB_ENV"
+          echo "SHA=$SHA" >> "$GITHUB_ENV"
+          docker build \
+            --build-arg VITE_API_URL="$HOMELAB_API_URL" \
+            --build-arg VITE_GOOGLE_CLIENT_ID="${{ secrets.VITE_GOOGLE_CLIENT_ID }}" \
+            --build-arg VITE_COMMIT_SHA=${{ github.sha }} \
+            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend:$SHA" .
+
+      - name: Push
+        if: github.event_name != 'pull_request'
+        run: |
+          set -eu
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
+          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
+          docker push "$IMAGE:$SHA"
+          docker push "$IMAGE:latest"
+          docker logout git.ffaerber.duckdns.org
+          {
+            echo "### Pushed"
+            echo
+            echo '```'
+            echo "$IMAGE:$SHA"
+            echo '```'
+            echo
+            echo "API baked in: $HOMELAB_API_URL"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
deleted file mode 100644
index 127de4b..0000000
--- a/.github/workflows/docker-image.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Docker Image CI
-
-on:
-  push:
-    branches: ['main', 'develop']
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.ref_name }}
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.sha }}
-          build-args: |
-            VITE_API_URL=https://api.t4t-gateway.com
-            VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }}
-            VITE_COMMIT_SHA=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: docker stack deploy
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          username: root
-          host: ${{ secrets.SSH_KNOWN_HOSTS }}
-          key: ${{ secrets.SSH_PRIV_KEY }}
-          script: |
-            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-            docker pull ghcr.io/token-for-token/hosted-gateway-frontend:main
-            docker stack deploy -c ~/devops/hostinger/prod-stack.yaml prod --with-registry-auth --resolve-image always
-            docker image prune -f --filter "until=24h"
-- 
2.54.0