ci/cd

.gitea/workflows/deploy.yaml

@@ -0,0 +1,39 @@
+name: Deployment
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy-docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v0.1.10
+        with:
+          host: 172.17.0.1
+          username: root
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          # Wir übergeben die Secrets als Environment-Variablen an den SSH-Befehl
+          envs: DB_USER,DB_PASSWORD
+          script: |
+            mkdir -p /root/iac
+            cd /root/iac
+            
+            # Repository aktualisieren
+            if [ ! -d ".git" ]; then
+              git clone https://git.bana.space/krumbelfix/iac.git .
+            else
+              git pull origin main
+            fi
+            
+            echo "hcloud_token = "${hetzner_token}" >> ./hetzner/terraform.tfvars
+            
+            # Docker Container neu bauen und starten
+            terraform plan
+            terraform apply
+            
+            echo "Deployment sucessfull"
+        env:
+          DB_USER: ${{ secrets.DB_USER }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

main.tf

@@ -23,9 +23,12 @@ resource "hcloud_server" "vps" {
   user_data   = local.user_data
 
   labels = {
+    app = "openclaw"
+    os = "ubuntu24"
+    virt = "docker"
     managed-by  = "terraform"
     environment = var.environment
-    purpose     = "openclaw"
+
   }
 }
 
@@ -33,14 +36,6 @@ resource "hcloud_server" "vps" {
 resource "hcloud_firewall" "vps" {
   name = "${var.server_name}-firewall"
 
-  # SSH: Tailscale CGNAT range + explicit allowed IPs
-  rule {
-    direction   = "in"
-    protocol    = "tcp"
-    port        = "22"
-    source_ips  = var.tailscale_auth_key != "" ? concat(["100.64.0.0/10"], var.allowed_ssh_ips) : var.allowed_ssh_ips
-    description = "SSH access"
-  }
 
   # ICMP for diagnostics
   rule {

scripts/cloud-init.sh

@@ -1,11 +1,6 @@
 #!/bin/bash
 set -euo pipefail
 
-# Variables from Terraform
-TAILSCALE_AUTH_KEY="${tailscale_auth_key}"
-USERNAME="${username}"
-SSH_PUBLIC_KEY="${ssh_public_key}"
-
 # Logging
 exec > >(tee /var/log/cloud-init-custom.log) 2>&1
 echo "=== Cloud-init started at $(date) ==="