pounce/.gitea/workflows/deploy.yml

name: Deploy Pounce

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H 185.142.213.170 >> ~/.ssh/known_hosts 2>/dev/null

      - name: Sync Backend Code
        run: |
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \
            --exclude '__pycache__' \
            --exclude '*.pyc' \
            --exclude '.git' \
            backend/ \
            administrator@185.142.213.170:/tmp/pounce-backend/

      - name: Sync Frontend Code
        run: |
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \
            --exclude 'node_modules' \
            --exclude '.next' \
            --exclude '.git' \
            frontend/ \
            administrator@185.142.213.170:/tmp/pounce-frontend/

      - name: Build and Deploy
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          GH_OAUTH_SECRET: ${{ secrets.GH_OAUTH_SECRET }}
          CZDS_USERNAME: ${{ secrets.CZDS_USERNAME }}
          CZDS_PASSWORD: ${{ secrets.CZDS_PASSWORD }}
        run: |
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no administrator@185.142.213.170 << 'DEPLOY_SCRIPT'
          
          # Build backend
          cd /tmp/pounce-backend
          sudo docker build -t pounce-backend:latest . || exit 1
          
          # Build frontend
          cd /tmp/pounce-frontend
          sudo docker build \
            --build-arg NEXT_PUBLIC_API_URL=https://api.pounce.ch \
            --build-arg BACKEND_URL=http://pounce-backend:8000 \
            -t pounce-frontend:latest . || exit 1
          
          echo "✅ Images built successfully"
          DEPLOY_SCRIPT

      - name: Deploy Containers
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          GH_OAUTH_SECRET: ${{ secrets.GH_OAUTH_SECRET }}
          CZDS_USERNAME: ${{ secrets.CZDS_USERNAME }}
          CZDS_PASSWORD: ${{ secrets.CZDS_PASSWORD }}
        run: |
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no administrator@185.142.213.170 << DEPLOY_CONTAINERS
          
          # Deploy Backend
          sudo docker stop pounce-backend 2>/dev/null || true
          sudo docker rm pounce-backend 2>/dev/null || true
          
          sudo mkdir -p /data/pounce/zones
          sudo chmod -R 777 /data/pounce/zones
          
          sudo docker run -d \
            --name pounce-backend \
            --network n0488s44osgoow4wgo04ogg0 \
            --restart unless-stopped \
            --shm-size=8g \
            -v /data/pounce/zones:/data \
            -e DATABASE_URL="${DATABASE_URL}" \
            -e SECRET_KEY="${SECRET_KEY}" \
            -e JWT_SECRET="${SECRET_KEY}" \
            -e REDIS_URL="redis://pounce-redis:6379/0" \
            -e ENABLE_SCHEDULER="true" \
            -e ENVIRONMENT="production" \
            -e CORS_ORIGINS="https://pounce.ch,https://www.pounce.ch" \
            -e COOKIE_SECURE="true" \
            -e SITE_URL="https://pounce.ch" \
            -e CZDS_DATA_DIR="/data/czds" \
            -e CZDS_USERNAME="${CZDS_USERNAME}" \
            -e CZDS_PASSWORD="${CZDS_PASSWORD}" \
            -e SMTP_HOST="smtp.zoho.eu" \
            -e SMTP_PORT="465" \
            -e SMTP_USER="hello@pounce.ch" \
            -e SMTP_PASSWORD="${SMTP_PASSWORD}" \
            -e SMTP_FROM_EMAIL="hello@pounce.ch" \
            -e SMTP_USE_SSL="true" \
            -e STRIPE_SECRET_KEY="${STRIPE_SECRET_KEY}" \
            -e STRIPE_PUBLISHABLE_KEY="pk_live_51ScLbjCtFUamNRpNeFugrlTIYhszbo8GovSGiMnPwHpZX9p3SGtgG8iRHYRIlAtg9M9sl3mvT5r8pwXP3mOsPALG00Wk3j0wH4" \
            -e STRIPE_PRICE_TRADER="price_1ScRlzCtFUamNRpNQdMpMzxV" \
            -e STRIPE_PRICE_TYCOON="price_1SdwhSCtFUamNRpNEXTSuGUc" \
            -e STRIPE_WEBHOOK_SECRET="${STRIPE_WEBHOOK_SECRET}" \
            -e GOOGLE_CLIENT_ID="865146315769-vi7vcu91d3i7huv8ikjun52jo9ob7spk.apps.googleusercontent.com" \
            -e GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}" \
            -e GOOGLE_REDIRECT_URI="https://pounce.ch/api/v1/oauth/google/callback" \
            -e GITHUB_CLIENT_ID="Ov23liBjROk39vYXi3G5" \
            -e GITHUB_CLIENT_SECRET="${GH_OAUTH_SECRET}" \
            -e GITHUB_REDIRECT_URI="https://pounce.ch/api/v1/oauth/github/callback" \
            -l "traefik.enable=true" \
            -l "traefik.http.routers.pounce-api.rule=Host(\\\`api.pounce.ch\\\`)" \
            -l "traefik.http.routers.pounce-api.entryPoints=https" \
            -l "traefik.http.routers.pounce-api.tls=true" \
            -l "traefik.http.routers.pounce-api.tls.certresolver=letsencrypt" \
            -l "traefik.http.services.pounce-api.loadbalancer.server.port=8000" \
            pounce-backend:latest
          
          sudo docker network connect coolify pounce-backend 2>/dev/null || true
          
          # Deploy Frontend
          sudo docker stop pounce-frontend 2>/dev/null || true
          sudo docker rm pounce-frontend 2>/dev/null || true
          
          sudo docker run -d \
            --name pounce-frontend \
            --network coolify \
            --restart unless-stopped \
            -l "traefik.enable=true" \
            -l "traefik.http.routers.pounce-web.rule=Host(\\\`pounce.ch\\\`) || Host(\\\`www.pounce.ch\\\`)" \
            -l "traefik.http.routers.pounce-web.entryPoints=https" \
            -l "traefik.http.routers.pounce-web.tls=true" \
            -l "traefik.http.routers.pounce-web.tls.certresolver=letsencrypt" \
            -l "traefik.http.services.pounce-web.loadbalancer.server.port=3000" \
            pounce-frontend:latest
          
          sudo docker network connect n0488s44osgoow4wgo04ogg0 pounce-frontend 2>/dev/null || true
          
          echo "✅ Containers deployed"
          DEPLOY_CONTAINERS

      - name: Health Check
        run: |
          sleep 20
          curl -sf https://api.pounce.ch/api/v1/health || echo "Backend starting..."
          curl -sf https://pounce.ch || echo "Frontend starting..."

      - name: Cleanup
        run: |
          ssh -i ~/.ssh/deploy_key administrator@185.142.213.170 "sudo docker image prune -f; sudo docker container prune -f"

      - name: Summary
        run: |
          echo "=========================================="
          echo "🎉 DEPLOYMENT SUCCESSFUL!"
          echo "=========================================="
          echo "Commit: ${{ github.sha }}"
          echo "Frontend: https://pounce.ch"
          echo "Backend:  https://api.pounce.ch"
          echo "=========================================="