From d6ff99e8a4b98f9d184c7df0c38015ef9466697a Mon Sep 17 00:00:00 2001
From: Devil <devil@devils.zone>
Date: Tue, 11 Aug 2026 14:18:30 +0200
Subject: [PATCH] feat(infrastructure): pull pre-built images from Gitea
 registry

migrate/api/worker/frontend now reference
git.devils.zone/devil/youtube-studio-flow-{backend,frontend}:\${IMAGE_TAG}
instead of building on the deploy host. Adds scripts/build-and-push.sh
to build+tag (git short SHA + latest) and push both images from a dev
machine, and updates infrastructure/README.md with the pull-based
deploy sequence.
---
 infrastructure/.env.example       |  6 +++++
 infrastructure/README.md          | 20 +++++++++++---
 infrastructure/docker-compose.yml | 21 +++++----------
 scripts/build-and-push.sh         | 43 +++++++++++++++++++++++++++++++
 4 files changed, 72 insertions(+), 18 deletions(-)
 create mode 100644 scripts/build-and-push.sh

diff --git a/infrastructure/.env.example b/infrastructure/.env.example
index 838c1a9..05b0341 100644
--- a/infrastructure/.env.example
+++ b/infrastructure/.env.example
@@ -2,6 +2,12 @@
 # The public domain Traefik routes to this app (no https://, no trailing slash).
 DOMAIN=yourdomain.com
 
+# ─── Image tag ────────────────────────────────────────────────────────────────
+# Which tag to pull from git.devils.zone/devil/youtube-studio-flow-{backend,frontend}.
+# Pin to a git short SHA or release tag for reproducible deploys; `latest` tracks
+# whatever scripts/build-and-push.sh last pushed.
+IMAGE_TAG=latest
+
 # ─── Postgres ─────────────────────────────────────────────────────────────────
 POSTGRES_USER=studioflow
 POSTGRES_PASSWORD=change_me_strong_password
diff --git a/infrastructure/README.md b/infrastructure/README.md
index 0bd7bd6..b6914f0 100644
--- a/infrastructure/README.md
+++ b/infrastructure/README.md
@@ -10,11 +10,23 @@ Dieses Verzeichnis enthält die Konfiguration für die lokale Entwicklung und da
 - **postgres:** PostgreSQL 16 (Port 5432)
 - **redis:** Redis 7 für Caching und Queues (Port 6379)
 
-## Schnellstart
+## Schnellstart (Server-Deployment)
+
+Images werden **nicht** auf dem Server gebaut — sie kommen fertig aus der Gitea Container
+Registry (`git.devils.zone/devil/youtube-studio-flow-{backend,frontend}`), gebaut per
+`scripts/build-and-push.sh` auf der Dev-Maschine.
+
 1. `.env.example` kopieren: `cp .env.example .env`
-2. Werte in `.env` anpassen (besonders Google API Keys).
-3. Container starten: `docker compose up -d`
-4. Datenbank migrieren: `docker compose run --rm migrate`
+2. Werte in `.env` anpassen (Secrets, Domain, Google API Keys, `IMAGE_TAG`).
+3. Am Server einloggen: `docker login git.devils.zone`
+4. Images ziehen: `docker compose pull`
+5. Datenbank migrieren: `docker compose run --rm migrate`
+6. Container starten: `docker compose up -d`
+
+Für ein Update auf eine neue Version: `IMAGE_TAG` in `.env` anpassen (oder `latest`
+belassen), dann Schritte 4–6 wiederholen. Das externe Docker-Netzwerk `traefik-network`
+muss vorher existieren (`docker network create traefik-network`), falls Traefik das nicht
+bereits selbst anlegt.
 
 ## Daten-Persistenz
 - PostgreSQL-Daten liegen im Volume `postgres_data`.
diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml
index 30011ca..47ad009 100644
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@@ -2,9 +2,7 @@ services:
 
   # Runs database migrations once before the API and worker start.
   migrate:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     command: npx prisma migrate deploy
     restart: "no"
     environment:
@@ -16,9 +14,7 @@ services:
       - app-network
 
   api:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     environment:
       NODE_ENV: production
@@ -57,9 +53,7 @@ services:
       - traefik-network
 
   worker:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     command: node dist/worker.js
     environment:
@@ -84,11 +78,10 @@ services:
       - app-network
 
   frontend:
-    build:
-      context: ../frontend
-      dockerfile: Dockerfile
-      # NEXT_PUBLIC_API_URL defaults to /api/v1 in the Dockerfile — no override needed.
-      # The relative path works because Traefik serves both frontend and API on the same domain.
+    # NEXT_PUBLIC_API_URL is baked in at build time (scripts/build-and-push.sh uses the
+    # Dockerfile default, /api/v1) — the relative path works because Traefik serves both
+    # frontend and API on the same domain.
+    image: git.devils.zone/devil/youtube-studio-flow-frontend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     labels:
       - "traefik.enable=true"
diff --git a/scripts/build-and-push.sh b/scripts/build-and-push.sh
new file mode 100644
index 0000000..0d2c95e
--- /dev/null
+++ b/scripts/build-and-push.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Builds the backend and frontend images and pushes them to the Gitea
+# container registry at git.devils.zone. Requires `docker login
+# git.devils.zone` to already be done (run that yourself, out of band, so
+# the token never ends up in a Claude transcript).
+#
+# Usage: scripts/build-and-push.sh [tag]
+#   tag   Extra tag to push alongside the git short SHA and `latest`.
+#         Useful for a release, e.g. scripts/build-and-push.sh v0.1.0
+
+set -euo pipefail
+
+REGISTRY="git.devils.zone"
+OWNER="devil"
+SHA=$(git rev-parse --short HEAD)
+EXTRA_TAG="${1:-}"
+
+BACKEND_IMAGE="${REGISTRY}/${OWNER}/youtube-studio-flow-backend"
+FRONTEND_IMAGE="${REGISTRY}/${OWNER}/youtube-studio-flow-frontend"
+
+echo "==> Building backend (${BACKEND_IMAGE}:${SHA})"
+docker build -t "${BACKEND_IMAGE}:${SHA}" -t "${BACKEND_IMAGE}:latest" ./backend
+
+echo "==> Building frontend (${FRONTEND_IMAGE}:${SHA})"
+docker build -t "${FRONTEND_IMAGE}:${SHA}" -t "${FRONTEND_IMAGE}:latest" ./frontend
+
+if [ -n "$EXTRA_TAG" ]; then
+  docker tag "${BACKEND_IMAGE}:${SHA}" "${BACKEND_IMAGE}:${EXTRA_TAG}"
+  docker tag "${FRONTEND_IMAGE}:${SHA}" "${FRONTEND_IMAGE}:${EXTRA_TAG}"
+fi
+
+echo "==> Pushing backend"
+docker push "${BACKEND_IMAGE}:${SHA}"
+docker push "${BACKEND_IMAGE}:latest"
+[ -n "$EXTRA_TAG" ] && docker push "${BACKEND_IMAGE}:${EXTRA_TAG}"
+
+echo "==> Pushing frontend"
+docker push "${FRONTEND_IMAGE}:${SHA}"
+docker push "${FRONTEND_IMAGE}:latest"
+[ -n "$EXTRA_TAG" ] && docker push "${FRONTEND_IMAGE}:${EXTRA_TAG}"
+
+echo "==> Done. Pushed tags: ${SHA}, latest${EXTRA_TAG:+, $EXTRA_TAG}"
+echo "    On the server: docker compose pull && docker compose run --rm migrate && docker compose up -d"