feat: update deployment configuration and encrypted env loader

- Update Ansible playbooks and roles for application deployment
- Add new Gitea/Traefik troubleshooting playbooks
- Update Docker Compose configurations (base, local, staging, production)
- Enhance EncryptedEnvLoader with improved error handling
- Add deployment scripts (autossh setup, migration, secret testing)
- Update CI/CD workflows and documentation
- Add Semaphore stack configuration

.gitea/workflows/ci.yml

@@ -15,9 +15,6 @@ on:
       - main
       - staging
 
-env:
-  CACHE_DIR: /tmp/composer-cache
-
 jobs:
   tests:
     name: Run Tests & Quality Checks
@@ -77,23 +74,27 @@ jobs:
 
           cd /workspace/repo
 
-      - name: Restore Composer cache
+      - name: Get Composer cache directory
+        id: composer-cache
+        shell: bash
         run: |
-          if [ -d "$CACHE_DIR/vendor" ]; then
-            echo "📦 Restore composer dependencies"
-            cp -r "$CACHE_DIR/vendor" /workspace/repo/vendor || true
-          fi
+          echo "dir=$(composer global config cache-dir 2>/dev/null | cut -d' ' -f3 || echo "$HOME/.composer/cache")" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ steps.composer-cache.outputs.dir }}
+            vendor/
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-composer-
 
       - name: Install PHP dependencies
         run: |
           cd /workspace/repo
           composer install --no-interaction --prefer-dist --optimize-autoloader --ignore-platform-req=php
 
-      - name: Save Composer cache
-        run: |
-          mkdir -p "$CACHE_DIR"
-          cp -r /workspace/repo/vendor "$CACHE_DIR/vendor" || true
-
       - name: PHPStan (baseline)
         run: |
           cd /workspace/repo
@@ -104,6 +105,42 @@ jobs:
           cd /workspace/repo
           make cs || echo "⚠️  php-cs-fixer dry run issues detected"
 
+      - name: Validate .env.base for secrets
+        run: |
+          cd /workspace/repo
+          if [ -f .env.base ]; then
+            echo "🔍 Checking .env.base for secrets..."
+            # Check for potential secrets (case-insensitive)
+            if grep -qiE "(password|secret|key|token|encryption|vault)" .env.base | grep -v "^#" | grep -v "FILE=" | grep -v "^$$" > /dev/null; then
+              echo "::error::.env.base contains potential secrets! Secrets should be in .env.local or Docker Secrets."
+              echo "⚠️  Found potential secrets in .env.base:"
+              grep -iE "(password|secret|key|token|encryption|vault)" .env.base | grep -v "^#" | grep -v "FILE=" | grep -v "^$$" || true
+              echo ""
+              echo "💡 Move secrets to:"
+              echo "   - .env.local (for local development)"
+              echo "   - Docker Secrets (for production/staging)"
+              exit 1
+            else
+              echo "✅ .env.base does not contain secrets"
+            fi
+          else
+            echo "ℹ️  .env.base not found (optional during migration)"
+          fi
+          
+          echo ""
+          echo "🔍 Checking docker-compose.base.yml for hardcoded passwords..."
+          if grep -E "(PASSWORD|SECRET|TOKEN).*:-[^}]*[^}]}" docker-compose.base.yml 2>/dev/null | grep -v "^#" | grep -v "FILE=" > /dev/null; then
+            echo "::error::docker-compose.base.yml contains hardcoded password fallbacks! Passwords must be set explicitly."
+            echo "⚠️  Found hardcoded password fallbacks:"
+            grep -E "(PASSWORD|SECRET|TOKEN).*:-[^}]*[^}]}" docker-compose.base.yml | grep -v "^#" | grep -v "FILE=" || true
+            echo ""
+            echo "💡 Remove fallback values (:-...) from base file"
+            echo "   Passwords must be set in .env.local or via Docker Secrets"
+            exit 1
+          else
+            echo "✅ docker-compose.base.yml does not contain hardcoded password fallbacks"
+          fi
+
       - name: Tests temporarily skipped
         run: |
           echo "⚠️  Tests temporarily skipped due to PHP 8.5 compatibility issues"