up

.gitea/workflows/deploy.yml

@@ -23,6 +23,11 @@ on:
         description: 'The deployment environment'
         required: true
         type: string
+      # The environment type (e.g., worker).
+      env_type:
+        description: 'The environment type'
+        required: true
+        type: string
 
     # ------------------ SECRETS ------------------
     # These are secrets that the calling workflow must pass.
@@ -52,18 +57,6 @@ on:
       VAULT_PASSWORD:
         description: 'Ansible Vault Password'
         required: true
-      # Docker registry username.
-      DOCKER_USERNAME:
-        description: 'Docker Registry Username'
-        required: true
-      # Docker registry password or token.
-      DOCKER_PASSWORD:
-        description: 'Docker Registry Password'
-        required: true
-      # The URL of the Docker registry.
-      DOCKER_REGISTRY:
-        description: 'Docker Registry URL'
-        required: true
       # The address of the HashiCorp Vault server.
       VAULT_ADDR:
         description: 'Vault server address (e.g., https://vault.example.com:8200)'
@@ -76,6 +69,11 @@ on:
       VAULT_SECRETS_PATH:
         description: 'Path to the secrets in Vault'
         required: true
+      # The URL of the Docker registry.
+      DOCKER_REGISTRY:
+        description: 'Docker Registry URL'
+        required: true
+        type: string
 
 jobs:
   # ============================================================================
@@ -178,7 +176,7 @@ jobs:
       contents: read
     outputs:
       image_tag: ${{ steps.meta.outputs.version }}
-      image_name: ${{ secrets.DOCKER_REGISTRY }}/${{ github.repository_owner }}/${{ inputs.app_name }}
+      image_name: ${{ inputs.DOCKER_REGISTRY }}/${{ github.repository_owner }}/${{ inputs.app_name }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -197,18 +195,18 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to Docker Registry
+      - name: Log in to Gitea's Docker Registry
         uses: docker/login-action@v3
         with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
+          registry: ${{ inputs.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
+          username: ${{ gitea.actor }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          password: ${{ secrets.token }}
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ secrets.DOCKER_REGISTRY }}/${{ github.repository_owner }}/${{ inputs.app_name }}
+          images: ${{ inputs.DOCKER_REGISTRY }}/${{ github.repository_owner }}/${{ inputs.app_name }}
           tags: |
             type=sha,prefix=,format=long
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
@@ -290,6 +288,6 @@ jobs:
                           docker_image_tag=${{ needs.build.outputs.image_tag }} \
                           docker_image_name=${{ needs.build.outputs.image_name }} \
                           docker_image_full=${{ needs.build.outputs.image_name }}:${{ needs.build.outputs.image_tag }} \
-                          docker_registry=${{ secrets.DOCKER_REGISTRY }} \
+                          docker_registry=${{ inputs.DOCKER_REGISTRY }} \
                           $auth_method_var" \
             --vault-password-file .vault_pass

.gitea/workflows/main.yml

@@ -11,26 +11,29 @@ on:
 jobs:
   # This job calls the reusable deployment workflow.
   deploy_service:
-    # Set the environment name based on the Git tag
+    # Set the environment name based on the Git tag. Default is 'development'.
-    environment: ${{ (contains(github.ref_name, '-dev.')) && 'development' || (contains(github.ref_name, '-stg.')) && 'staging' || 'production' }}
+    environment: ${{ (contains(github.ref_name, '-stg.')) && 'staging' || (contains(github.ref_name, '-prod.')) && 'production' || 'development' }}
     
     uses: devops/ansible-gitea/.gitea/workflows/deploy.yml@main
     
     # Provide the specific inputs for this application.
     with:
       app_name: ${{ github.event.repository.name }}
-      deploy_env: ${{ (contains(github.ref_name, '-dev.')) && 'development' || (contains(github.ref_name, '-stg.')) && 'staging' || 'production' }}
+      # Set deploy_env based on the Git tag. Default is 'development'.
+      deploy_env: ${{ (contains(github.ref_name, '-stg.')) && 'staging' || (contains(github.ref_name, '-prod.')) && 'production' || 'development' }}
       env_type: ${{ (contains(github.ref_name, 'worker')) && 'worker' || '' }}
       
     # Pass the required secrets to the reusable workflow.
-    # These secrets must be configured in the Gitea settings for this repository.
+    # These secrets must be configured in the Gitea settings for this repository
+    # with suffixes _DEV, _STG, _PROD. The workflow defaults to _DEV secrets.
     secrets:
-      SERVER_HOST: ${{ secrets.SERVER_HOST }}
+      SERVER_HOST: ${{ (contains(github.ref_name, '-stg.')) && vars.SERVER_HOST_STG || (contains(github.ref_name, '-prod.')) && vars.SERVER_HOST_PROD || vars.SERVER_HOST_DEV || 'localhost' }}
-      SERVER_PORT: ${{ secrets.SERVER_PORT }}
+      SERVER_PORT: ${{ (contains(github.ref_name, '-stg.')) && vars.SERVER_PORT_STG || (contains(github.ref_name, '-prod.')) && vars.SERVER_PORT_PROD || vars.SERVER_PORT_DEV || '22' }}
-      SERVER_USER: ${{ secrets.SERVER_USER }}
+      SERVER_USER: ${{ (contains(github.ref_name, '-stg.')) && vars.SERVER_USER_STG || (contains(github.ref_name, '-prod.')) && vars.SERVER_USER_PROD || vars.SERVER_USER_DEV || 'cicd' }}
-      SERVER_SSH_PRIVATE_KEY: ${{ secrets.SERVER_SSH_PRIVATE_KEY }}
+      SERVER_SSH_PRIVATE_KEY: ${{ (contains(github.ref_name, '-stg.')) && secrets.SERVER_SSH_PRIVATE_KEY_STG || (contains(github.ref_name, '-prod.')) && secrets.SERVER_SSH_PRIVATE_KEY_PROD || secrets.SERVER_SSH_PRIVATE_KEY_DEV || '' }}
-      SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
+      SERVER_PASSWORD: ${{ (contains(github.ref_name, '-stg.')) && secrets.SERVER_PASSWORD_STG || (contains(github.ref_name, '-prod.')) && secrets.SERVER_PASSWORD_PROD || secrets.SERVER_PASSWORD_DEV || '' }}
       VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }}
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      VAULT_SECRETS_PATH: ${{ secrets.VAULT_SECRETS_PATH }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      VAULT_ROLE: ${{ vars.VAULT_ROLE }}
-      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      VAULT_ADDR: ${{ vars.VAULT_ADDR || 'https://vault.nguoiduathu.eu.org' }}
+      DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY || gitea.instance }}