Deploy from GitHub with a systemd timer instead of Gitea Actions

Cosmos keeps a deploy-only clone of the GitHub repo. gk-deploy.timer runs
pull-and-deploy.sh every 5 minutes: it fetches master and, when it has
moved, runs deploy.sh (build, check, restart, roll back if unhealthy). A
commit that failed is not retried until master moves (FORCE=1 retries), and
DEPLOY_HEALTHCHECK_URL turns red on a failed fetch or deploy. Removes the
Gitea workflow and updates the runbook, README and inventory note.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

docs/deploy.md

@@ -16,7 +16,7 @@ Files in the repo:
 - `deploy/compose.yaml`: the stack. Containers run as the vault's owner, with a read-only root filesystem, no capabilities and `no-new-privileges`.
 - `deploy/deploy.sh`: builds `check`, then the three images tagged with the commit, and restarts the stack. If the new containers aren't healthy within two minutes, it puts the last good tag back. Run it again on the same commit and it does nothing (`FORCE=1` rebuilds).
 - `deploy/rollback.sh`: switches to the previous tag. Run it again to roll forward.
-- `.gitea/workflows/deploy.yml`: runs `deploy.sh` on Cosmos for each new commit to master.
+- `deploy/pull-and-deploy.sh`, with `deploy/gk-deploy.service` and `gk-deploy.timer`: every 5 minutes, Cosmos fetches master from GitHub into its own clone of the repo and runs `deploy.sh` when master has moved. A commit that failed to deploy isn't retried until master moves again.
 
 ## On Cosmos
 
@@ -24,8 +24,9 @@ Everything lives in `/home/greg/homelab/gregkilmer`:
 
 ```
 /home/greg/homelab/gregkilmer/
+  repo/             clone of github.com/Patiun/com.gregkilmer.www, for deploys only
   compose.yaml      copied from deploy/compose.yaml by every deploy
-  .env              GK_TAG, GK_PREVIOUS_TAG, VAULT_SITE, PUID, PGID
+  .env              GK_TAG, GK_PREVIOUS_TAG, VAULT_SITE, PUID, PGID, DEPLOY_HEALTHCHECK_URL
   content.env       content service secrets and sync settings
   admin.env         ADMIN_TOKEN
   site.env          site secrets: tokens, Turnstile, SMTP
@@ -36,15 +37,24 @@ Kopia already covers `/home/greg`, so the `.env` files and `data/` are in the en
 
 ## First-time setup
 
-1. **Folder and settings.** Run these from a checkout of the repo:
+1. **Clone and settings.** The repo is private, so give Cosmos read-only access with a deploy key:
+
+   ```sh
+   ssh-keygen -t ed25519 -N "" -C cosmos-gregkilmer-deploy -f ~/.ssh/gregkilmer_deploy
+   ```
+
+   Add `~/.ssh/gregkilmer_deploy.pub` on GitHub under the repo's Settings, then Deploy keys, with write access left off. Then:
 
    ```sh
    mkdir -p /home/greg/homelab/gregkilmer/data/content
    cd /home/greg/homelab/gregkilmer
-   cp <repo>/deploy/stack.env.example .env
-   cp <repo>/services/content/.env.example content.env
-   cp <repo>/deploy/admin.env.example admin.env
-   cp <repo>/services/site/.env.example site.env
+   GIT_SSH_COMMAND="ssh -i ~/.ssh/gregkilmer_deploy -o IdentitiesOnly=yes" \
+     git clone git@github.com:Patiun/com.gregkilmer.www.git repo
+   git -C repo config core.sshCommand "ssh -i ~/.ssh/gregkilmer_deploy -o IdentitiesOnly=yes"
+   cp repo/deploy/stack.env.example .env
+   cp repo/services/content/.env.example content.env
+   cp repo/deploy/admin.env.example admin.env
+   cp repo/services/site/.env.example site.env
    chmod 600 .env *.env
    ```
 
@@ -60,18 +70,28 @@ Kopia already covers `/home/greg`, so the `.env` files and `data/` are in the en
 
 3. **The rest of the settings.** Fill in Healthchecks, the Discord webhook, Turnstile, SMTP and the sync logins. The list is in `/mnt/project-files/website/phase6/setup-on-cosmos.md` and in each `.env.example`.
 
-4. **Gitea runner.** The workflow needs an `act_runner` on Cosmos with the label `cosmos` running in host mode (`cosmos:host`). It runs as a user in the `docker` group with write access to `/home/greg/homelab/gregkilmer`.
-   - A runner with the Docker socket is root-equivalent. Register it for this repository only, not for the whole instance.
+4. **First deploy.** Run it by hand once and watch it:
 
-5. **Gitea mirror.** Mirror `github.com/Patiun/com.gregkilmer.www` into Gitea as a pull mirror and turn Actions on for it.
-   - A pull mirror's sync may not raise a push event. The workflow therefore also runs every 15 minutes and deploys only when master has moved.
-   - Check once that a new commit reaches Cosmos. If the schedule doesn't fire on a mirror either, run the workflow by hand from the Actions tab.
+   ```sh
+   /home/greg/homelab/gregkilmer/repo/deploy/pull-and-deploy.sh
+   ```
 
-6. **First deploy.** Run it from the Actions tab, or by hand from a checkout: `./deploy/deploy.sh`. Then check:
+   Then check:
    - `docker compose -f /home/greg/homelab/gregkilmer/compose.yaml ps` shows three healthy containers.
    - `docker logs gk-content` says `Content service on 0.0.0.0:4310: N notes`.
 
-7. **Nginx Proxy Manager.** Add a proxy host for each hostname. Force SSL on each. For `content`, add `proxy_buffering off;` under Advanced, because MCP streams its responses.
+5. **Deploy timer.** This makes every later merge to master deploy on its own:
+
+   ```sh
+   sudo cp /home/greg/homelab/gregkilmer/repo/deploy/gk-deploy.{service,timer} /etc/systemd/system/
+   sudo systemctl daemon-reload && sudo systemctl enable --now gk-deploy.timer
+   ```
+
+   - The service runs as `greg`, who must be in the `docker` group.
+   - Make a Healthchecks check with a 5-minute period, and set its URL as `DEPLOY_HEALTHCHECK_URL` in `.env`. It turns red when GitHub can't be reached or a commit fails to deploy.
+   - Logs: `journalctl -u gk-deploy`.
+
+6. **Nginx Proxy Manager.** Add a proxy host for each hostname. Force SSL on each. For `content`, add `proxy_buffering off;` under Advanced, because MCP streams its responses.
 
    | Host | Forward to | Access list |
    | --- | --- | --- |
@@ -83,13 +103,13 @@ Kopia already covers `/home/greg`, so the `.env` files and `data/` are in the en
    - Certificates: Let's Encrypt can't reach a tailnet-only host over HTTP, so use NPM's DNS challenge with your DNS provider. This is the same open item as the `*.patiun.com` certificate.
    - Agents already on homelab_network can skip NPM and use `http://gk-content:4310/mcp`.
 
-8. **Turnstile.** Add `beta.gregkilmer.com` and `gregkilmer.com` to the widget's hostnames.
+7. **Turnstile.** Add `beta.gregkilmer.com` and `gregkilmer.com` to the widget's hostnames.
 
-9. **Healthchecks.** Create these checks:
+8. **Healthchecks.** Create these checks:
    - one for the content service's full scan (`HEALTHCHECK_URL`), every 5 minutes;
    - one per sync job you turn on (Archidekt, Suwayomi, Bambuddy and Homebox hourly; BGG and Kavita daily; covers every 15 minutes).
 
-10. **Inventory note.** Copy `vault-kit/24.01_PersonalWebsite/GregKilmer.com stack.md` into the vault's `24.01_PersonalWebsite` folder, so `cosmos-inventory` stops listing the containers as undocumented.
+9. **Inventory note.** Copy `vault-kit/24.01_PersonalWebsite/GregKilmer.com stack.md` into the vault's `24.01_PersonalWebsite` folder, so `cosmos-inventory` stops listing the containers as undocumented.
 
 ## Backups
 
@@ -108,7 +128,8 @@ Kopia already covers `/home/greg`, so the `.env` files and `data/` are in the en
 
 ## Day to day
 
-- **Deploy:** merge to master on GitHub; Gitea mirrors it and the workflow deploys it.
-- **Roll back:** `GK_STACK_DIR=/home/greg/homelab/gregkilmer ./deploy/rollback.sh` from a checkout, or set `GK_TAG` in `.env` to any image tag still on the host and run `docker compose up -d`.
+- **Deploy:** merge to master on GitHub. Cosmos picks it up within 5 minutes. To deploy straight away, run `sudo systemctl start gk-deploy`.
+- **Retry a failed commit:** `FORCE=1 /home/greg/homelab/gregkilmer/repo/deploy/pull-and-deploy.sh`.
+- **Roll back:** `/home/greg/homelab/gregkilmer/repo/deploy/rollback.sh`, or set `GK_TAG` in `.env` to any image tag still on the host and run `docker compose up -d`.
 - **Logs:** `docker logs gk-content`. Sync runs also appear on the admin page's Overview.
 - **Restart one service:** `docker compose -f /home/greg/homelab/gregkilmer/compose.yaml restart gk-site`.