Revert "Refactor Gitea production deployment process to utilize SSH for remote operations"

This reverts commit 99bc36439e.

scripts/deploy-production.sh

@@ -1,20 +1,20 @@
 #!/usr/bin/env bash
-# Pull and deploy on server B with configuration injected over SSH by Gitea.
-# Returns nonzero on configuration/pull/migration/health failure. Never removes data.
+# Deploy on the target Linux Docker host with configuration injected by Gitea.
+# Returns nonzero on configuration/build/migration/health failure. Never removes data.
 set -Eeuo pipefail
 umask 077
 
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 # Fail before touching the host; never read a checkout's local .env file.
-for key in IMAGE_PREFIX DEPLOY_TAG REGISTRY_USERNAME REGISTRY_PASSWORD WQ_EMAIL WQ_PASSWORD DATABASE_URL ADMIN_PASSWORD ENCRYPTION_KEY PUBLIC_ORIGIN; do
+for key in WQ_EMAIL WQ_PASSWORD DATABASE_URL ADMIN_PASSWORD ENCRYPTION_KEY DATABASE_NETWORK PUBLIC_ORIGIN; do
   if [[ -z "${!key:-}" ]]; then
     echo "Missing required Gitea configuration: $key" >&2
     exit 1
   fi
 done
+export DEPLOY_TAG="${DEPLOY_TAG:-$(git rev-parse HEAD)}"
 compose=(docker compose --env-file /dev/null -p wq-alpha-production -f compose.production.yaml)
 lock_id=""
-auth_dir=""
 cleanup() {
   local rc=$?
   "${compose[@]}" --profile jobs ps -a || true
@@ -22,34 +22,25 @@ cleanup() {
   if [[ -n "$lock_id" ]]; then
     docker rm "$lock_id" >/dev/null || true
   fi
-  if [[ -n "$auth_dir" ]]; then
-    rm -rf -- "$auth_dir"
-  fi
   exit "$rc"
 }
 trap cleanup EXIT
 trap 'exit 130' INT
 trap 'exit 143' TERM
-trap 'exit 129' HUP
 
 "${compose[@]}" config --quiet
 "${compose[@]}" --profile jobs config --quiet
-auth_dir=$(mktemp -d)
-export DOCKER_CONFIG="$auth_dir"
-printf '%s' "$REGISTRY_PASSWORD" | docker login "${IMAGE_PREFIX%%/*}" --username "$REGISTRY_USERNAME" --password-stdin
-unset REGISTRY_PASSWORD
-# Download both images before stopping anything; migration uses the backend image.
-"${compose[@]}" pull --policy always backend web
+"${compose[@]}" build backend web
 # Docker enforces unique container names across runner jobs and checkout paths.
 # The lock container is never started and receives no deployment credentials.
 if ! lock_id=$(docker create --name wq-alpha-production-deploy-lock \
   --label "wq.deploy.commit=$DEPLOY_TAG" \
-  --network none --entrypoint /bin/true "$IMAGE_PREFIX-backend:$DEPLOY_TAG"); then
+  --network none --entrypoint /bin/true "wq-alpha-production-backend:$DEPLOY_TAG"); then
   echo 'Cannot acquire deployment lock; check Docker and other active deployments.' >&2
   exit 1
 fi
 # Validate secrets and DB connectivity before interrupting the running version.
-"${compose[@]}" run --rm --no-deps --pull never -T backend python -c '
+"${compose[@]}" run --rm --no-deps backend python -c '
 import asyncio
 from app.config import Settings
 from sqlalchemy import text
@@ -75,6 +66,6 @@ if [[ -n "$previous_images" ]]; then
   docker image inspect --format '{{.Id}} {{json .RepoTags}}' $previous_images
 fi
 "${compose[@]}" stop web backend
-"${compose[@]}" --profile jobs run --rm --no-deps --pull never -T migrate
-"${compose[@]}" up -d --no-build --pull never --remove-orphans --wait --wait-timeout 180 backend web
+"${compose[@]}" --profile jobs run --rm --no-deps migrate
+"${compose[@]}" up -d --no-build --remove-orphans --wait --wait-timeout 180 backend web
 echo "Production is healthy; release $DEPLOY_TAG"