feat: update deployment configuration and encrypted env loader

- Update Ansible playbooks and roles for application deployment
- Add new Gitea/Traefik troubleshooting playbooks
- Update Docker Compose configurations (base, local, staging, production)
- Enhance EncryptedEnvLoader with improved error handling
- Add deployment scripts (autossh setup, migration, secret testing)
- Update CI/CD workflows and documentation
- Add Semaphore stack configuration

deployment/stacks/application/docker-compose.yml

@@ -25,11 +25,16 @@ services:
       - DB_PORT=${DB_PORT:-5432}
       - DB_DATABASE=${DB_DATABASE}
       - DB_USERNAME=${DB_USERNAME}
-      - DB_PASSWORD=${DB_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
       # Redis
       - REDIS_HOST=redis
       - REDIS_PORT=6379
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+    secrets:
+      - db_user_password
+      - redis_password
       # Cache
       - CACHE_DRIVER=redis
       - CACHE_PREFIX=${CACHE_PREFIX:-app}
@@ -181,22 +186,24 @@ services:
       - app-internal
     environment:
       - TZ=Europe/Berlin
+    secrets:
+      - redis_password
     command: >
-      redis-server
-      --requirepass ${REDIS_PASSWORD}
+      sh -c "redis-server
+      --requirepass $$(cat /run/secrets/redis_password)
       --maxmemory 512mb
       --maxmemory-policy allkeys-lru
       --save 900 1
       --save 300 10
       --save 60 10000
       --appendonly yes
-      --appendfsync everysec
+      --appendfsync everysec"
     volumes:
       - redis-data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     healthcheck:
-      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
+      test: ["CMD", "sh", "-c", "redis-cli --no-auth-warning -a $$(cat /run/secrets/redis_password) ping"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -218,11 +225,16 @@ services:
       - DB_PORT=${DB_PORT:-5432}
       - DB_DATABASE=${DB_DATABASE}
       - DB_USERNAME=${DB_USERNAME}
-      - DB_PASSWORD=${DB_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
       # Redis
       - REDIS_HOST=redis
       - REDIS_PORT=6379
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+    secrets:
+      - db_user_password
+      - redis_password
       # Queue
       - QUEUE_DRIVER=redis
       - QUEUE_CONNECTION=default
@@ -234,6 +246,9 @@ services:
       - app-logs:/var/www/html/storage/logs
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
+    secrets:
+      - db_user_password
+      - redis_password
     command: php console.php queue:work --queue=default --timeout=${QUEUE_WORKER_TIMEOUT:-60}
     healthcheck:
       test: ["CMD-SHELL", "php -r 'exit(0);' && test -f /var/www/html/console.php || exit 1"]
@@ -263,11 +278,16 @@ services:
       - DB_PORT=${DB_PORT:-5432}
       - DB_DATABASE=${DB_DATABASE}
       - DB_USERNAME=${DB_USERNAME}
-      - DB_PASSWORD=${DB_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
       # Redis
       - REDIS_HOST=redis
       - REDIS_PORT=6379
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+    secrets:
+      - db_user_password
+      - redis_password
     volumes:
       - app-storage:/var/www/html/storage
       - app-logs:/var/www/html/storage/logs
@@ -300,6 +320,12 @@ volumes:
     name: redis-data
     external: true
 
+secrets:
+  db_user_password:
+    file: ./secrets/db_user_password.txt
+  redis_password:
+    file: ./secrets/redis_password.txt
+
 networks:
   traefik-public:
     external: true