chore: Update deployment configuration and documentation

- Update Gitea configuration (remove DEFAULT_ACTIONS_URL)
- Fix deployment documentation
- Update Ansible playbooks
- Clean up deprecated files
- Add new deployment scripts and templates

deployment/stacks/application/docker-compose.yml

@@ -1,10 +1,9 @@
-version: '3.8'
 # Docker Registry: registry.michaelschiemer.de (HTTPS via Traefik)
 
 services:
   # PHP-FPM Application Runtime
   app:
-    image: registry.michaelschiemer.de/framework:latest
+    image: git.michaelschiemer.de:5000/framework:latest
     container_name: app
     restart: unless-stopped
     networks:
@@ -55,8 +54,9 @@ services:
         condition: service_started
 
   # Nginx Web Server
+  # Uses same image as app - clones code from Git if GIT_REPOSITORY_URL is set, then runs nginx
   nginx:
-    image: nginx:1.25-alpine
+    image: git.michaelschiemer.de:5000/framework:latest
     container_name: nginx
     restart: unless-stopped
     networks:
@@ -64,12 +64,89 @@ services:
       - app-internal
     environment:
       - TZ=Europe/Berlin
+      - APP_ENV=${APP_ENV:-production}
+      - APP_DEBUG=${APP_DEBUG:-false}
+      # Git Repository (same as app - will clone code on start)
+      - GIT_REPOSITORY_URL=${GIT_REPOSITORY_URL:-}
+      - GIT_BRANCH=${GIT_BRANCH:-main}
+      - GIT_TOKEN=${GIT_TOKEN:-}
+      - GIT_USERNAME=${GIT_USERNAME:-}
+      - GIT_PASSWORD=${GIT_PASSWORD:-}
     volumes:
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - app-code:/var/www/html:ro
       - app-storage:/var/www/html/storage:ro
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
+    # Use custom entrypoint that ensures code is available then starts nginx only (no PHP-FPM)
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        # Ensure code is available in /var/www/html (from image or Git)
+        GIT_TARGET_DIR="/var/www/html"
+        
+        # If storage is mounted but code is missing, copy from image's original location
+        if [ ! -d "$$GIT_TARGET_DIR/public" ] && [ -d "/var/www/html.orig" ]; then
+          echo "?? [nginx] Copying code from image..."
+          # Copy everything except storage (which is a volume mount)
+          find /var/www/html.orig -mindepth 1 -maxdepth 1 ! -name "storage" -exec cp -r {} "$$GIT_TARGET_DIR/" \; 2>/dev/null || true
+        fi
+        
+        if [ -n "$$GIT_REPOSITORY_URL" ]; then
+          # Configure Git to be non-interactive
+          export GIT_TERMINAL_PROMPT=0
+          export GIT_ASKPASS=echo
+
+          # Determine authentication method
+
+
+          if [ -n "$$GIT_TOKEN" ]; then
+            GIT_URL_WITH_AUTH=$$(echo "$$GIT_REPOSITORY_URL" | sed "s|https://|https://$${GIT_TOKEN}@|")
+          elif [ -n "$$GIT_USERNAME" ] && [ -n "$$GIT_PASSWORD" ]; then
+            GIT_URL_WITH_AUTH=$$(echo "$$GIT_REPOSITORY_URL" | sed "s|https://|https://$${GIT_USERNAME}:$${GIT_PASSWORD}@|")
+          else
+            echo "⚠️  [nginx] No Git credentials provided (GIT_TOKEN or GIT_USERNAME/GIT_PASSWORD). Using image contents."
+            GIT_URL_WITH_AUTH=""
+          fi
+
+
+          if [ -n "$$GIT_URL_WITH_AUTH" ] && [ ! -d "$$GIT_TARGET_DIR/.git" ]; then
+            echo "?? [nginx] Cloning repository from $$GIT_REPOSITORY_URL (branch: $${GIT_BRANCH:-main})..."
+            # Remove only files/dirs that are not storage (which is a volume mount)
+            # Clone into a temporary directory first, then move contents
+            TEMP_CLONE="$${GIT_TARGET_DIR}.tmp"
+            rm -rf "$$TEMP_CLONE" 2>/dev/null || true
+            if git clone --branch "$${GIT_BRANCH:-main}" --depth 1 "$$GIT_URL_WITH_AUTH" "$$TEMP_CLONE"; then
+              # Remove only files/dirs that are not storage (which is a volume mount)
+              find "$$GIT_TARGET_DIR" -mindepth 1 -maxdepth 1 ! -name "storage" -exec rm -rf {} \\; 2>/dev/null || true
+              # Move contents from temp directory to target (preserving storage)
+              find "$$TEMP_CLONE" -mindepth 1 -maxdepth 1 ! -name "." ! -name ".." -exec mv {} "$$GIT_TARGET_DIR/" \\; 2>/dev/null || true
+              rm -rf "$$TEMP_CLONE" 2>/dev/null || true
+              echo "✅ [nginx] Repository cloned successfully"
+            else
+              echo "? Git clone failed. Using image contents."
+              rm -rf "$$TEMP_CLONE" 2>/dev/null || true
+            fi
+          else
+            echo "?? [nginx] Pulling latest changes..."
+            cd "$$GIT_TARGET_DIR"
+            git fetch origin "$${GIT_BRANCH:-main}" || true
+            git reset --hard "origin/$${GIT_BRANCH:-main}" || true
+            git clean -fd || true
+          fi
+          if [ -f "$$GIT_TARGET_DIR/composer.json" ]; then
+            echo "?? [nginx] Installing dependencies..."
+            cd "$$GIT_TARGET_DIR"
+            composer install --no-dev --optimize-autoloader --no-interaction --no-scripts || true
+            composer dump-autoload --optimize --classmap-authoritative || true
+          fi
+          echo "? [nginx] Git sync completed"
+        else
+          echo "??  [nginx] GIT_REPOSITORY_URL not set, using code from image"
+        fi
+        
+        # Start nginx only (no PHP-FPM)
+        echo "?? [nginx] Starting nginx..."
+        exec nginx -g "daemon off;"
     labels:
       - "traefik.enable=true"
       # HTTP Router
@@ -84,7 +161,7 @@ services:
       # Network
       - "traefik.docker.network=traefik-public"
     healthcheck:
-      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1/health || exit 1"]
+      test: ["CMD-SHELL", "curl -f http://127.0.0.1/health || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -125,7 +202,7 @@ services:
 
   # Queue Worker (Background Jobs)
   queue-worker:
-    image: registry.michaelschiemer.de/framework:latest
+    image: git.michaelschiemer.de:5000/framework:latest
     container_name: queue-worker
     restart: unless-stopped
     networks:
@@ -170,7 +247,7 @@ services:
 
   # Scheduler (Cron Jobs)
   scheduler:
-    image: registry.michaelschiemer.de/framework:latest
+    image: git.michaelschiemer.de:5000/framework:latest
     container_name: scheduler
     restart: unless-stopped
     networks: