changed to v3

only wanted to exec pipeline

.gitea/workflows/cicd.yaml

@@ -1,20 +1,141 @@
-name: Hello from Gitea Actions
+# .gitea/workflows/cicd.yaml
+name: Build and Deploy Demo App (Artifacts, GHES/Gitea-safe)
 
 on:
-  push:            # run on every push
+  push:
-    branches:
+    branches: [ main ]
-      - main       # adjust if your default branch is different
 
 jobs:
-  hello:
+  # ---------- TEST ----------
-    runs-on: devops   # must match your runner's label
+  test:
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Say hello
+      - name: Set up Python
-        run: |
+        uses: actions/setup-python@v5
-          echo "Hello from Gitea Actions!"
+        with:
-          echo "Runner: ${{ runner.name }}"
+          python-version: "3.12"
-          echo "Repo:   ${{ gitea.repository }}"
 
+      - name: Install deps
+        run: pip install -r requirements.txt
+
+      - name: Run tests (SQLite fallback)
+        env:
+          DB_USER: ""   # force SQLite fallback in app.py
+          DB_PASS: ""
+          DB_NAME: ""
+        run: pytest
+
+  # ---------- BUILD ----------
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t demo-app:latest .
+
+      - name: Save Docker image to tar
+        run: docker save demo-app:latest > demo-app.tar
+
+      # IMPORTANT: use v3 on Gitea/GHES
+      - name: Upload image artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: demo-image
+          path: demo-app.tar
+          if-no-files-found: error
+          # retention-days: 7   # optional; depends on your Gitea settings
+
+  # ---------- SCAN ----------
+  scan:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # IMPORTANT: use v3 on Gitea/GHES
+      - name: Download image artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: demo-image
+          path: .   # place demo-app.tar in the workspace root
+
+      - name: Load Docker image from artifact
+        run: docker load -i demo-app.tar
+
+      - name: Scan image with Trivy
+        run: |
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            aquasec/trivy:latest \
+            image --exit-code 1 --severity CRITICAL,HIGH --no-progress demo-app:latest
+
+  # ---------- DEPLOY ----------
+  deploy:
+    needs: [build, scan]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # IMPORTANT: use v3 on Gitea/GHES
+      - name: Download image artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: demo-image
+          path: .
+
+      - name: Set up SSH
+        run: |
+          apt update && apt install -y openssh-client
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          eval "$(ssh-agent -s)"
+          ssh-add ~/.ssh/id_ed25519
+          ssh-keyscan -p ${{ secrets.SERVER_PORT }} ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts
+
+      - name: Copy files to server
+        run: |
+          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
+            demo-app.tar \
+            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.DEPLOY_PATH }}/demo-app.tar"
+
+          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
+            docker-compose.yml \
+            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.DEPLOY_PATH }}/docker-compose.yml"
+
+          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} -r \
+            nginx_user_conf.d \
+            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.DEPLOY_PATH }}/nginx_user_conf.d"
+
+      - name: Deploy on server
+        run: |
+          ssh -o StrictHostKeyChecking=no -p ${{ secrets.SERVER_PORT }} \
+            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }} << 'EOF'
+            set -e
+            cd "${{ secrets.DEPLOY_PATH }}"
+
+            # Write DB secrets for compose
+            echo "DB_USER=${{ secrets.DB_USER }}" > .env
+            echo "DB_PASS=${{ secrets.DB_PASS }}" >> .env
+            echo "DB_NAME=${{ secrets.DB_NAME }}" >> .env
+
+            # Load image and restart stack
+            docker load -i demo-app.tar
+            if [ ! -f docker-compose.yml ]; then
+              echo "ERROR: docker-compose.yml not found in $(pwd)" >&2
+              ls -la
+              exit 1
+            fi
+            docker compose -f docker-compose.yml down
+            docker compose -f docker-compose.yml --env-file .env up -d --remove-orphans
+
+            rm -f demo-app.tar
+          EOF

Dockerfile

@@ -0,0 +1,21 @@
+# Build stage
+FROM python:3.12-slim AS builder
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Runtime stage
+FROM python:3.12-slim
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+# NEW: Copy binaries like gunicorn
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY app.py models.py .
+COPY templates ./templates
+# NEW: Install wget for healthcheck (run as root, before switching user)
+RUN apt-get update && apt-get install -y --no-install-recommends wget && rm -rf /var/lib/apt/lists/*
+RUN useradd -m appuser
+USER appuser
+EXPOSE 5000
+HEALTHCHECK --interval=30s --timeout=3s CMD wget --no-verbose --tries=1 --spider http://localhost:5000/ || exit 1
+CMD ["gunicorn", "--bind", "0.0.0.0:5000", "app:app"]

README.md

@@ -1,3 +1,5 @@
-# devops
+# tags: DevOps CI/CD Pipeline Gitea Docker
 
-DevOps PPC
+DevOps CI/CD Pipeline Demo Application
+
+Prod project implementation

app.py

@@ -0,0 +1,38 @@
+import os
+from flask import Flask, render_template
+from flask_bootstrap import Bootstrap5
+from models import db, Feature
+
+app = Flask(__name__)
+
+# Database config
+db_user = os.getenv('DB_USER')
+db_pass = os.getenv('DB_PASS')
+db_name = os.getenv('DB_NAME')
+app.config['SQLALCHEMY_DATABASE_URI'] = (
+    f'postgresql://{db_user}:{db_pass}@db:5432/{db_name}'
+    if db_user else 'sqlite:///:memory:'
+)
+app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
+
+bootstrap = Bootstrap5(app)
+db.init_app(app)
+
+# ────────────────────────────────
+# THIS IS THE MISSING PART:
+# Create tables + seed data ONCE at startup
+# ────────────────────────────────
+with app.app_context():
+    db.create_all()          # ← Creates the "feature" table if missing
+    Feature.seed_db()        # ← Now works without error
+
+@app.route('/')
+def index():
+    features = Feature.query.all()
+    return render_template('index.html', features=features)
+
+
+# Optional: nice health endpoint that doesn't touch DB
+@app.route('/health')
+def health():
+    return "OK", 200

docker-compose.yml

@@ -0,0 +1,65 @@
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: demo-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASS}
+      POSTGRES_DB: ${DB_NAME}
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  app:
+    image: demo-app:latest
+    container_name: demo-app
+    restart: unless-stopped
+    environment:
+      - DB_USER=${DB_USER}
+      - DB_PASS=${DB_PASS}
+      - DB_NAME=${DB_NAME}
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "http://localhost:5000"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  nginx:
+    image: jonasal/nginx-certbot:latest
+    container_name: demo-nginx
+    restart: unless-stopped
+    ports:
+      - 8008:80
+      - 4433:443
+    environment:
+      - CERTBOT_EMAIL=the.dark.mist23@gmail.com
+      - ENVSUBST_TEMPLATE_SUFFIX=.tmpl
+      - CERTBOT_DISABLED=true
+    volumes:
+      - ./nginx_user_conf.d:/etc/nginx/conf.d/
+      - letsencrypt:/etc/letsencrypt
+      - /home/devroot/demo/certs/fullchain.pem:/etc/nginx/ssl/origin_cert.pem:ro
+      - /home/devroot/demo/certs/prvkey.pem:/etc/nginx/ssl/origin_key.key:ro
+    depends_on:
+      app:
+        condition: service_healthy
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+
+networks:
+  default:
+    driver: bridge
+
+volumes:
+  letsencrypt:
+  db-data:

models.py

@@ -0,0 +1,31 @@
+from flask_sqlalchemy import SQLAlchemy
+
+db = SQLAlchemy()
+
+
+class Feature(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    title = db.Column(db.String(100), nullable=False)
+    description = db.Column(db.String(200), nullable=False)
+
+    @staticmethod
+    def seed_db():
+        # Seed only if empty
+        if Feature.query.count() == 0:
+            features = [
+                Feature(
+                    title="Responsive Design",
+                    description="Adapts seamlessly to mobile, tablet, and desktop devices.",
+                ),
+                Feature(
+                    title="Modern UI",
+                    description="Uses Bootstrap 5 for clean, professional styling.",
+                ),
+                Feature(
+                    title="Easy Deployment",
+                    description="Containerized with Docker for quick setup on any server.",
+                ),
+            ]
+            db.session.bulk_save_objects(features)
+            db.session.commit()
+

nginx_user_conf.d/server.conf

@@ -0,0 +1,32 @@
+server {
+    listen 80;
+    server_name demo.networkwizard.xyz;
+    location / {
+        return 301 https://$host:4433$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name demo.networkwizard.xyz;
+    ssl_certificate /etc/nginx/ssl/origin_cert.pem;
+    ssl_certificate_key /etc/nginx/ssl/origin_key.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    client_max_body_size 2g;     # allow big artifacts
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+
+    location / {
+        proxy_pass http://app:5000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /usr/share/nginx/html;
+    }
+}

requirements.txt

@@ -0,0 +1,6 @@
+flask==3.0.3
+bootstrap-flask==2.5.0
+gunicorn==22.0.0
+flask-sqlalchemy==3.1.1
+psycopg2-binary==2.9.9  # Postgres driver
+pytest==8.3.3  # For tests

templates/index.html

@@ -0,0 +1,72 @@
+<!doctype html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Professional Demo Site</title>
+    {{ bootstrap.load_css() }}
+    <style>
+        body { padding-top: 60px; }
+    </style>
+</head>
+
+<body>
+    <nav class="navbar navbar-expand-lg navbar-dark bg-dark fixed-top">
+        <div class="container">
+            <a class="navbar-brand" href="/">Professional Demo Site V3</a>
+            <button class="navbar-toggler" type="button" data-bs-toggle="collapse"
+                    data-bs-target="#navbarNav" aria-controls="navbarNav"
+                    aria-expanded="false" aria-label="Toggle navigation">
+                <span class="navbar-toggler-icon"></span>
+            </button>
+
+            <div class="collapse navbar-collapse" id="navbarNav">
+                <ul class="navbar-nav ms-auto">
+                    <li class="nav-item"><a class="nav-link" href="/">Home</a></li>
+                    <li class="nav-item"><a class="nav-link" href="#features">Features</a></li>
+                    <li class="nav-item"><a class="nav-link" href="#about">About</a></li>
+                </ul>
+            </div>
+        </div>
+    </nav>
+
+    <div class="container">
+
+        <div class="bg-primary text-white py-5 mt-4 rounded text-center">
+            <h1 class="display-4">Professional Demo Site</h1>
+            <p class="lead">
+                This is a realistic, Bootstrap-powered Flask application with DB integration for demonstration.
+            </p>
+            <a class="btn btn-light btn-lg" href="#features" role="button">Learn More</a>
+        </div>
+
+        <section id="features" class="py-5">
+            <h2 class="text-center mb-4">Key Features (from DB)</h2>
+            <div class="row">
+
+                {% for feature in features %}
+                <div class="col-md-4">
+                    <div class="card mb-4">
+                        <div class="card-body">
+                            <h5 class="card-title">{{ feature.title }}</h5>
+                            <p class="card-text">{{ feature.description }}</p>
+                        </div>
+                    </div>
+                </div>
+                {% endfor %}
+
+            </div>
+        </section>
+
+        <section id="about" class="py-5 bg-light">
+            <h2 class="text-center mb-4">About This Demo</h2>
+            <p class="text-center">
+                Now with PostgreSQL for data persistence. Extend with more models and queries.
+            </p>
+        </section>
+
+    </div>
+
+    {{ bootstrap.load_js() }}
+</body>
+</html>

test_app.py

@@ -0,0 +1,40 @@
+import os
+import pytest
+
+# Ensure tests always use the in-memory SQLite DB, even if CI sets DB_* secrets
+for var in ("DB_USER", "DB_PASS", "DB_NAME"):
+    os.environ.pop(var, None)
+
+from app import app
+from models import db, Feature
+
+
+@pytest.fixture
+def client():
+    app.config["TESTING"] = True
+    # app was already initialised with SQLite because DB_USER is now unset
+
+    # Fresh DB per test
+    with app.app_context():
+        db.drop_all()
+        db.create_all()
+
+    with app.test_client() as client:
+        yield client
+
+    # Clean up after test
+    with app.app_context():
+        db.drop_all()
+
+
+def test_index(client):
+    response = client.get("/")
+    assert response.status_code == 200
+    assert b"Professional Demo Site" in response.data
+
+
+def test_seed_db(client):
+    with app.app_context():
+        Feature.seed_db()
+        assert Feature.query.count() == 3
+