feat: Update workflows for Token-based Git clone

.gitea/workflows/production.yml

@@ -7,26 +7,23 @@ on:
 
 jobs:
   production:
-    runs-on: ubuntu-latest
+    runs-on: production
     steps:
       - name: Checkout
         uses: actions/checkout@v3
         with:
           submodules: true
 
-      - name: SSH Key einrichten
+      - name: Configure Git Token
         run: |
-          mkdir -p ~/.ssh
+          git config --global url."https://sebastian.serfling:${{ secrets.GIT_TOKEN }}@gitlab.stines.de/".insteadOf "https://gitlab.stines.de/"
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          echo "${{ secrets.PROD_HOST_KEY }}" >> ~/.ssh/known_hosts
 
-      - name: Hugo Build
+      - name: Hugo Build & Deploy
-        run: hugo --minify --source ./hugo
-
-      - name: Deploy auf Production
         run: |
-          rsync -az --delete \
+          set -e
-            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \
+
-            ./hugo/public/ \
+          # Hugo Build direkt in /var/www/html
-            root@${{ secrets.PROD_IP }}:/var/www/html/
+          hugo --minify --source ./hugo -d /var/www/html
+
+          echo "✅ Production Hugo Build erfolgreich!"
+          echo "🚀 Live unter https://stines.de"

.gitea/workflows/staging.yml

@@ -7,14 +7,14 @@ on:
 
 jobs:
   staging:
-    runs-on: ubuntu-latest
+    runs-on: proxmox
     steps:
       - name: Checkout
         uses: actions/checkout@v3
         with:
           submodules: true
 
-      - name: Terraform Init & Apply (Staging LXC)
+      - name: Terraform Init & Apply (Staging LXC erstellen)
         working-directory: terraform
         run: |
           terraform init
@@ -23,25 +23,43 @@ jobs:
             -var="proxmox_token_id=${{ secrets.PROXMOX_TOKEN_ID }}" \
             -var="proxmox_token_secret=${{ secrets.PROXMOX_TOKEN_SECRET }}" \
             -var="proxmox_node=${{ secrets.PROXMOX_NODE }}" \
+            -var="lxc_bridge=vmbr2" \
             -var="staging_ip=${{ secrets.STAGING_IP }}" \
             -var="staging_gw=${{ secrets.STAGING_GW }}" \
-            -var="ssh_public_key=${{ secrets.DEPLOY_SSH_PUBKEY }}"
+            -var="ssh_public_key=${{ secrets.DEPLOY_SSH_PUBKEY }}" \
+            -var="ssh_private_key=${{ secrets.DEPLOY_SSH_KEY }}"
         env:
           TF_IN_AUTOMATION: "true"
 
-      - name: SSH Key einrichten
+      - name: Warte auf LXC Boot
+        run: sleep 30
+
+      - name: SSH Key Setup
         run: |
           mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/staging_key
-          chmod 600 ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/staging_key
-          echo "${{ secrets.STAGING_HOST_KEY }}" >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.STAGING_IP }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
-      - name: Hugo Build
+      - name: Hugo Clone & Build auf Staging-LXC
-        run: hugo --minify --source ./hugo
-
-      - name: Deploy auf Staging
         run: |
-          rsync -az --delete \
+          ssh -i ~/.ssh/staging_key -o StrictHostKeyChecking=no deploy@${{ secrets.STAGING_IP }} bash << 'EOF'
-            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \
+          set -e
-            ./hugo/public/ \
+          cd /tmp
-            root@${{ secrets.STAGING_IP_PLAIN }}:/var/www/html/
+
+          # Repository clonen mit Token (oder updaten falls existiert)
+          GIT_URL="https://sebastian.serfling:${{ secrets.GIT_TOKEN }}@gitlab.stines.de/sebastian.serfling/Webseite_Stines.git"
+
+          if [ -d "webseite" ]; then
+            cd webseite
+            git pull origin main
+          else
+            git clone "$GIT_URL" webseite
+            cd webseite
+          fi
+
+          # Hugo Build direkt in /var/www/html
+          hugo --minify --source ./hugo -d /var/www/html
+
+          echo "✅ Staging Hugo Build erfolgreich!"
+          EOF

terraform/main.tf

@@ -17,25 +17,26 @@ provider "proxmox" {
 resource "proxmox_lxc" "staging" {
   target_node  = var.proxmox_node
   hostname     = "hugo-staging"
+  vmid         = 200
   ostemplate   = var.lxc_ostemplate
   unprivileged = true
   start        = true
   onboot       = false
 
-  cores  = 1
+  cores  = 2
-  memory = 512
+  memory = 1024
   swap   = 512
 
   rootfs {
     storage = var.lxc_storage
-    size    = "8G"
+    size    = "10G"
   }
 
   network {
     name   = "eth0"
-    bridge = "vmbr0"
+    bridge = var.lxc_bridge
-    ip     = var.staging_ip
+    ip     = "${var.staging_ip}/24"
-    gw     = var.staging_gw != "" ? var.staging_gw : null
+    gw     = var.staging_gw
   }
 
   ssh_public_keys = var.ssh_public_key
@@ -43,18 +44,26 @@ resource "proxmox_lxc" "staging" {
   provisioner "remote-exec" {
     inline = [
       "apt-get update -qq",
-      "apt-get install -y nginx",
+      "apt-get install -y hugo nginx git rsync curl",
       "systemctl enable --now nginx",
+      "useradd -m -s /bin/bash deploy || true",
+      "mkdir -p /home/deploy/.ssh",
+      "chmod 700 /home/deploy/.ssh",
+      "echo '${var.ssh_public_key}' >> /home/deploy/.ssh/authorized_keys",
+      "chmod 600 /home/deploy/.ssh/authorized_keys",
+      "chown -R deploy:deploy /home/deploy/.ssh",
       "mkdir -p /var/www/html",
-      "chown -R www-data:www-data /var/www/html"
+      "chown -R deploy:deploy /var/www/html"
     ]
     connection {
       type        = "ssh"
       user        = "root"
-      private_key = file("~/.ssh/deploy_key")
+      private_key = var.ssh_private_key
       host        = self.network[0].ip
     }
   }
+
+  depends_on = []
 }
 
 output "staging_ip" {

terraform/variables.tf

@@ -17,7 +17,11 @@ variable "proxmox_token_secret" {
 variable "proxmox_node" {
   description = "Ziel-Proxmox-Node"
   type        = string
-  default     = "pve"
+}
+
+variable "lxc_bridge" {
+  description = "Netzwerk-Bridge (z.B. vmbr2)"
+  type        = string
 }
 
 variable "lxc_ostemplate" {
@@ -33,18 +37,24 @@ variable "lxc_storage" {
 }
 
 variable "staging_ip" {
-  description = "Statische IP fuer Staging-LXC (CIDR)"
+  description = "Statische IP fuer Staging-LXC (ohne CIDR)"
   type        = string
-  default     = "dhcp"
+  default     = "172.17.1.100"
 }
 
 variable "staging_gw" {
   description = "Gateway fuer Staging-LXC"
   type        = string
-  default     = ""
+  default     = "172.17.1.1"
 }
 
 variable "ssh_public_key" {
-  description = "SSH Public Key fuer den deploy-User im LXC"
+  description = "SSH Public Key fuer deploy-User im LXC"
   type        = string
 }
+
+variable "ssh_private_key" {
+  description = "SSH Private Key (für Provisioning)"
+  type        = string
+  sensitive   = true
+}