Refactor Gitea production deployment process to utilize SSH for remote operations

- Updated deployment specification to reflect the new architecture involving servers A, B, and C.
- Revised README to describe the new deployment method using Gitea Runner and SSH.
- Modified `compose.production.yaml` to remove build context and use image tags directly.
- Enhanced deployment documentation to clarify configuration steps and environment variable requirements.
- Introduced `deploy-remote.sh` script for handling remote deployment tasks over SSH.
- Added unit tests for deployment scripts to ensure robustness and error handling.
- Updated `deploy-production.sh` to streamline image pulling and deployment processes.

.gitea/workflows/deploy-production.yaml

@@ -6,23 +6,60 @@ on:
 
 jobs:
   deploy:
-    # Reuse the runner that deploys zhixing-system to the same Docker host.
+    # Build on the runner; the production Docker daemon is reached only over SSH.
     runs-on: ubuntu-latest
+    env:
+      IMAGE_PREFIX: ${{ vars.IMAGE_PREFIX }}
+      DEPLOY_TAG: ${{ gitea.sha }}
     steps:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
         with:
           persist-credentials: false
-      - name: Build, migrate and deploy
+      - name: Build and push to Gitea Packages
         shell: bash
         env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          BUILD_PLATFORM: ${{ vars.BUILD_PLATFORM }}
+        run: |
+          set -Eeuo pipefail
+          umask 077
+          : "${IMAGE_PREFIX:?Set IMAGE_PREFIX to registry/owner/image (without a scheme or tag)}"
+          : "${DEPLOY_TAG:?Missing commit SHA}"
+          : "${REGISTRY_USERNAME:?Set REGISTRY_USERNAME}"
+          : "${REGISTRY_PASSWORD:?Set REGISTRY_PASSWORD}"
+          registry="${IMAGE_PREFIX%%/*}"
+          auth_dir=$(mktemp -d)
+          trap 'rm -rf -- "$auth_dir"' EXIT
+          export DOCKER_CONFIG="$auth_dir"
+          printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" --username "$REGISTRY_USERNAME" --password-stdin
+          unset REGISTRY_PASSWORD
+          docker build --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
+            --label "org.opencontainers.image.revision=$DEPLOY_TAG" \
+            -f Dockerfile.backend -t "$IMAGE_PREFIX-backend:$DEPLOY_TAG" .
+          docker build --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
+            --label "org.opencontainers.image.revision=$DEPLOY_TAG" \
+            -f Dockerfile.frontend -t "$IMAGE_PREFIX-web:$DEPLOY_TAG" .
+          docker push "$IMAGE_PREFIX-backend:$DEPLOY_TAG"
+          docker push "$IMAGE_PREFIX-web:$DEPLOY_TAG"
+      - name: Pull, migrate and deploy on server B
+        shell: bash
+        env:
+          PROD_HOST: ${{ secrets.PROD_HOST }}
+          PROD_PORT: ${{ secrets.PROD_PORT }}
+          PROD_USER: ${{ secrets.PROD_USER }}
+          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+          PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
+          PROD_KNOWN_HOSTS: ${{ secrets.PROD_KNOWN_HOSTS }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
           ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
           WQ_EMAIL: ${{ secrets.WQ_EMAIL }}
           WQ_PASSWORD: ${{ secrets.WQ_PASSWORD }}
           ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
           ADMIN_USERNAME: ${{ vars.ADMIN_USERNAME }}
-          DATABASE_NETWORK: ${{ vars.DATABASE_NETWORK }}
           PUBLIC_ORIGIN: ${{ vars.PUBLIC_ORIGIN }}
           MCP_ENABLED: ${{ vars.MCP_ENABLED }}
-        run: bash scripts/deploy-production.sh
+        run: bash scripts/deploy-remote.sh