Load content from Gitea directly, drop the local clone; add deploy workflow

load_questions_from_gitea (content.rs) fetches question YAML straight from the questions repo's public Gitea contents API at startup instead of scanning a local directory - one fewer moving part in production (no git clone to keep in sync, no separate questions-repo deploy workflow). Still just an in-memory startup load, same as before - served from RAM for every request, no per-request network call. Verified against the real repo (all 5 questions fetch correctly). CONTENT_DIR is replaced by CONTENT_REPO/CONTENT_BRANCH, defaulting to the real questions repo so local dev needs no env override. Also adds .gitea/workflows/deploy.yml: builds with cargo-leptos, ships the release under /srv/app/uhhm-portal (the generic app@.service deploy layout), writes /etc/app/uhhm-portal.env from this repo's own Actions Variables/Secrets, restarts the service, and drops this app's Caddy routing snippet into services.d/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-31 06:10:06 +02:00
parent aa1a7fa572
commit 286fdbf67f
3 changed files with 133 additions and 18 deletions
@@ -0,0 +1,62 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: bare
+    env:
+      # The bare runner's own systemd service intentionally has a minimal
+      # PATH/HOME (no rustup default toolchain in reach) - point it at the
+      # shared toolchain install directly rather than assuming an ambient
+      # dev shell environment.
+      CARGO_HOME: /var/local/cargo
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: cargo leptos build --release
+
+      - name: Ship release
+        run: |
+          set -euo pipefail
+          rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
+          mkdir -p "$rel"
+          cp target/release/portal "$rel/uhhm-portal"
+          cp -r target/site "$rel/site"
+          ln -sfn "$rel" /srv/app/uhhm-portal/current
+
+      # Sourced from this repo's own Settings -> Actions Variables/Secrets,
+      # not typed onto the host by hand - see the infrastructure repo's
+      # deploy-runner plan for the exact names/values to configure once.
+      - name: Write service env
+        run: |
+          cat > /etc/app/uhhm-portal.env <<EOF
+          NATS_URL=${{ secrets.PORTAL_NATS_URL }}
+          KANIDM_URL=${{ vars.PORTAL_KANIDM_URL }}
+          OAUTH2_CLIENT_ID=${{ vars.PORTAL_OAUTH2_CLIENT_ID }}
+          OAUTH2_CLIENT_SECRET=${{ secrets.PORTAL_OAUTH2_CLIENT_SECRET }}
+          PUBLIC_URL=${{ vars.PORTAL_PUBLIC_URL }}
+          COOKIE_SECURE=true
+          CONTENT_REPO=https://project.uhhm.no/uhhm/questions
+          CONTENT_BRANCH=main
+          SITE_NAME=${{ vars.PORTAL_SITE_NAME }}
+          LEPTOS_SITE_ADDR=0.0.0.0:3010
+          EOF
+
+      - name: Restart service
+        run: sudo systemctl restart app@uhhm-portal.service
+
+      - name: Update Caddy routing
+        run: |
+          cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
+          www.{$DOMAIN}, {$DOMAIN} {
+          	reverse_proxy host.docker.internal:3010
+          	log { output file /var/log/caddy/www.log }
+          }
+          EOF
+          sudo docker exec caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile