feat: update deployment configuration and encrypted env loader

- Update Ansible playbooks and roles for application deployment
- Add new Gitea/Traefik troubleshooting playbooks
- Update Docker Compose configurations (base, local, staging, production)
- Enhance EncryptedEnvLoader with improved error handling
- Add deployment scripts (autossh setup, migration, secret testing)
- Update CI/CD workflows and documentation
- Add Semaphore stack configuration

docker-compose.staging.yml

@@ -0,0 +1,410 @@
+# Staging Environment Override
+# Usage: docker-compose -f docker-compose.base.yml -f docker-compose.staging.yml up
+#
+# This file overrides base configuration with staging-specific settings:
+# - Container names with "staging-" prefix
+# - Traefik integration for staging.michaelschiemer.de
+# - Git clone functionality for staging branch
+# - Staging-specific networks (traefik-public, staging-internal)
+# - Staging-specific volumes
+
+services:
+  # PHP-FPM Application Runtime
+  staging-app:
+    image: git.michaelschiemer.de:5000/framework:latest
+    container_name: staging-app
+    restart: unless-stopped
+    networks:
+      - staging-internal
+    environment:
+      - TZ=Europe/Berlin
+      - APP_ENV=staging
+      - APP_DEBUG=${APP_DEBUG:-true}
+      - APP_URL=https://staging.michaelschiemer.de
+      - APP_KEY=${APP_KEY:-}
+      # Git Repository - clones staging branch
+      - GIT_REPOSITORY_URL=${GIT_REPOSITORY_URL:-}
+      - GIT_BRANCH=staging
+      - GIT_TOKEN=${GIT_TOKEN:-}
+      - GIT_USERNAME=${GIT_USERNAME:-}
+      - GIT_PASSWORD=${GIT_PASSWORD:-}
+      # Database (can share with production or use separate)
+      - DB_HOST=${DB_HOST:-postgres}
+      - DB_PORT=${DB_PORT:-5432}
+      - DB_DATABASE=${DB_DATABASE:-michaelschiemer_staging}
+      - DB_USERNAME=${DB_USERNAME}
+      - DB_PASSWORD=${DB_PASSWORD}
+      # Redis
+      - REDIS_HOST=staging-redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      # Cache
+      - CACHE_DRIVER=redis
+      - CACHE_PREFIX=${CACHE_PREFIX:-staging}
+      # Session
+      - SESSION_DRIVER=redis
+      - SESSION_LIFETIME=${SESSION_LIFETIME:-120}
+      # Queue
+      - QUEUE_DRIVER=redis
+      - QUEUE_CONNECTION=default
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
+      - APP_KEY_FILE=/run/secrets/app_key
+      - VAULT_ENCRYPTION_KEY_FILE=/run/secrets/vault_encryption_key
+      - GIT_TOKEN_FILE=/run/secrets/git_token
+    volumes:
+      - staging-code:/var/www/html
+      - staging-storage:/var/www/html/storage
+      - staging-logs:/var/www/html/storage/logs
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    secrets:
+      - db_user_password
+      - app_key
+      - vault_encryption_key
+      - git_token
+    # Override entrypoint to only start PHP-FPM (not nginx) + fix git ownership
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        
+        # Fix Git ownership issue
+        # Ensure Git treats the mounted repository as safe regardless of owner
+        git config --global --add safe.directory /var/www/html 2>/dev/null || true
+        git config --system --add safe.directory /var/www/html 2>/dev/null || true
+        
+        # Git Clone/Pull functionality
+        if [ -n "$GIT_REPOSITORY_URL" ]; then
+          echo ""
+          echo "📥 Cloning/Pulling code from Git repository..."
+          
+          GIT_BRANCH="${GIT_BRANCH:-main}"
+          GIT_TARGET_DIR="/var/www/html"
+          
+          # Setup Git credentials
+          if [ -n "$GIT_TOKEN" ]; then
+            GIT_URL_WITH_AUTH=$(echo "$GIT_REPOSITORY_URL" | sed "s|https://|https://${GIT_TOKEN}@|")
+          elif [ -n "$GIT_USERNAME" ] && [ -n "$GIT_PASSWORD" ]; then
+            GIT_URL_WITH_AUTH=$(echo "$GIT_REPOSITORY_URL" | sed "s|https://|https://${GIT_USERNAME}:${GIT_PASSWORD}@|")
+          else
+            GIT_URL_WITH_AUTH="$GIT_REPOSITORY_URL"
+          fi
+          
+          # Clone or pull
+          if [ ! -d "$GIT_TARGET_DIR/.git" ]; then
+            echo "📥 Cloning repository from $GIT_REPOSITORY_URL (branch: $GIT_BRANCH)..."
+            if [ "$(ls -A $GIT_TARGET_DIR 2>/dev/null)" ]; then
+              find "$GIT_TARGET_DIR" -mindepth 1 -maxdepth 1 ! -name "storage" -exec rm -rf {} \; 2>/dev/null || true
+            fi
+            TEMP_CLONE="${GIT_TARGET_DIR}.tmp"
+            rm -rf "$TEMP_CLONE" 2>/dev/null || true
+            if git -c safe.directory=/var/www/html clone --branch "$GIT_BRANCH" --depth 1 "$GIT_URL_WITH_AUTH" "$TEMP_CLONE"; then
+              find "$GIT_TARGET_DIR" -mindepth 1 -maxdepth 1 ! -name "storage" -exec rm -rf {} \; 2>/dev/null || true
+              find "$TEMP_CLONE" -mindepth 1 -maxdepth 1 ! -name "." ! -name ".." -exec mv {} "$GIT_TARGET_DIR/" \; 2>/dev/null || true
+              rm -rf "$TEMP_CLONE" 2>/dev/null || true
+              echo "✅ Repository cloned successfully"
+            fi
+          else
+            echo "🔄 Pulling latest changes from $GIT_BRANCH..."
+            cd "$GIT_TARGET_DIR"
+            git -c safe.directory=/var/www/html fetch origin "$GIT_BRANCH" || echo "⚠️  Git fetch failed"
+            git -c safe.directory=/var/www/html reset --hard "origin/$GIT_BRANCH" || echo "⚠️  Git reset failed"
+            git -c safe.directory=/var/www/html clean -fd || true
+          fi
+          
+          # Install dependencies
+          if [ -f "$GIT_TARGET_DIR/composer.json" ]; then
+            echo "📦 Installing/updating Composer dependencies..."
+            cd "$GIT_TARGET_DIR"
+            composer install --no-dev --optimize-autoloader --no-interaction --no-scripts || echo "⚠️  Composer install failed"
+            composer dump-autoload --optimize --classmap-authoritative || true
+          fi
+          
+          echo "✅ Git sync completed"
+        else
+          echo ""
+          echo "ℹ️  GIT_REPOSITORY_URL not set, using code from image"
+        fi
+        
+        echo ""
+        echo "📊 Environment variables:"
+        env | grep -E "DB_|APP_" | grep -v "PASSWORD|KEY|SECRET" || true
+
+        echo ""
+        echo "🛠️ Adjusting filesystem permissions..."
+        chown -R www-data:www-data /var/www/html/storage /var/www/html/bootstrap/cache 2>/dev/null || true
+        find /var/www/html/storage /var/www/html/bootstrap/cache -type d -exec chmod 775 {} \; 2>/dev/null || true
+        find /var/www/html/storage /var/www/html/bootstrap/cache -type f -exec chmod 664 {} \; 2>/dev/null || true
+        
+        # Start PHP-FPM only (no nginx)
+        echo ""
+        echo "🚀 Starting PHP-FPM..."
+        exec php-fpm
+    healthcheck:
+      test: ["CMD-SHELL", "php-fpm-healthcheck || true"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    depends_on:
+      staging-redis:
+        condition: service_started
+  # Nginx Web Server
+  staging-nginx:
+    image: git.michaelschiemer.de:5000/framework:latest
+    container_name: staging-nginx
+    restart: unless-stopped
+    networks:
+      - traefik-public
+      - staging-internal
+    environment:
+      - TZ=Europe/Berlin
+      - APP_ENV=staging
+      - APP_DEBUG=${APP_DEBUG:-true}
+      # Git Repository - clones staging branch
+      - GIT_REPOSITORY_URL=${GIT_REPOSITORY_URL:-}
+      - GIT_BRANCH=staging
+      - GIT_TOKEN=${GIT_TOKEN:-}
+      - GIT_USERNAME=${GIT_USERNAME:-}
+      - GIT_PASSWORD=${GIT_PASSWORD:-}
+    volumes:
+      - ./deployment/stacks/staging/nginx/conf.d:/etc/nginx/conf.d:ro
+      - staging-code:/var/www/html:ro
+      - staging-storage:/var/www/html/storage:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    # Wait for code to be available (cloned by staging-app container) then start nginx
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        # Wait for code to be available in shared volume (staging-app container clones it)
+        GIT_TARGET_DIR="/var/www/html"
+        echo "⏳ [staging-nginx] Waiting for code to be available in shared volume..."
+        for i in 1 2 3 4 5 6 7 8 9 10; do
+          if [ -d "$$GIT_TARGET_DIR/public" ]; then
+            echo "✅ [staging-nginx] Code found in shared volume"
+            break
+          fi
+          echo "   [staging-nginx] Waiting... ($$i/10)"
+          sleep 2
+        done
+        
+        # If code still not available after wait, try to copy from image as fallback
+        if [ ! -d "$$GIT_TARGET_DIR/public" ] && [ -d "/var/www/html.orig" ]; then
+          echo "⚠️  [staging-nginx] Code not found in shared volume, copying from image..."
+          find /var/www/html.orig -mindepth 1 -maxdepth 1 ! -name "storage" -exec cp -r {} "$$GIT_TARGET_DIR/" \; 2>/dev/null || true
+        fi
+        
+        # Fix nginx upstream configuration - sites-enabled/default overrides conf.d/default.conf
+        # This is critical: nginx sites-available/default uses 127.0.0.1:9000 but PHP-FPM runs in staging-app container
+        if [ -f "/etc/nginx/sites-available/default" ]; then
+          echo "🔧 [staging-nginx] Fixing PHP-FPM upstream configuration..."
+          # Replace in upstream block
+          sed -i '/upstream php-upstream {/,/}/s|server 127.0.0.1:9000;|server staging-app:9000;|g' /etc/nginx/sites-available/default || true
+          sed -i '/upstream php-upstream {/,/}/s|server localhost:9000;|server staging-app:9000;|g' /etc/nginx/sites-available/default || true
+          # Replace any direct fastcgi_pass references too
+          sed -i 's|fastcgi_pass 127.0.0.1:9000;|fastcgi_pass php-upstream;|g' /etc/nginx/sites-available/default || true
+          sed -i 's|fastcgi_pass localhost:9000;|fastcgi_pass php-upstream;|g' /etc/nginx/sites-available/default || true
+          echo "✅ [staging-nginx] PHP-FPM upstream fixed"
+        fi
+        
+        # Start nginx only (no PHP-FPM, no Git clone - staging-app container handles that)
+        echo "🚀 [staging-nginx] Starting nginx..."
+        exec nginx -g "daemon off;"
+    labels:
+      - "traefik.enable=true"
+      # HTTP Router for staging subdomain
+      - "traefik.http.routers.staging.rule=Host(`staging.michaelschiemer.de`)"
+      - "traefik.http.routers.staging.entrypoints=websecure"
+      - "traefik.http.routers.staging.tls=true"
+      - "traefik.http.routers.staging.tls.certresolver=letsencrypt"
+      # Service
+      - "traefik.http.services.staging.loadbalancer.server.port=80"
+      # Middleware
+      - "traefik.http.routers.staging.middlewares=default-chain@file"
+      # Network
+      - "traefik.docker.network=traefik-public"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://127.0.0.1/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    depends_on:
+      staging-app:
+        condition: service_started
+    # Remove base service dependencies and build
+    ports: []
+
+  # Redis Cache/Session/Queue Backend (separate from production)
+  staging-redis:
+    image: redis:7-alpine
+    container_name: staging-redis
+    restart: unless-stopped
+    networks:
+      - staging-internal
+    environment:
+      - TZ=Europe/Berlin
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+    secrets:
+      - redis_password
+    command: >
+      sh -c "
+      REDIS_PASSWORD=$$(cat /run/secrets/redis_password 2>/dev/null || echo ${REDIS_PASSWORD})
+      redis-server
+      --requirepass $$REDIS_PASSWORD
+      --maxmemory 256mb
+      --maxmemory-policy allkeys-lru
+      --save 900 1
+      --save 300 10
+      --save 60 10000
+      --appendonly yes
+      --appendfsync everysec
+      "
+    volumes:
+      - staging-redis-data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+
+  # Queue Worker (Background Jobs)
+  staging-queue-worker:
+    image: git.michaelschiemer.de:5000/framework:latest
+    container_name: staging-queue-worker
+    restart: unless-stopped
+    networks:
+      - staging-internal
+    environment:
+      - TZ=Europe/Berlin
+      - APP_ENV=staging
+      - APP_DEBUG=${APP_DEBUG:-true}
+      # Database
+      - DB_HOST=${DB_HOST:-postgres}
+      - DB_PORT=${DB_PORT:-5432}
+      - DB_DATABASE=${DB_DATABASE:-michaelschiemer_staging}
+      - DB_USERNAME=${DB_USERNAME}
+      - DB_PASSWORD=${DB_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
+      # Redis
+      - REDIS_HOST=staging-redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+      # Queue
+      - QUEUE_DRIVER=redis
+      - QUEUE_CONNECTION=default
+      - QUEUE_WORKER_SLEEP=${QUEUE_WORKER_SLEEP:-3}
+      - QUEUE_WORKER_TRIES=${QUEUE_WORKER_TRIES:-3}
+      - QUEUE_WORKER_TIMEOUT=${QUEUE_WORKER_TIMEOUT:-60}
+    volumes:
+      - staging-code:/var/www/html
+      - staging-storage:/var/www/html/storage
+      - staging-logs:/var/www/html/storage/logs
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    command: php console.php queue:work --queue=default --timeout=${QUEUE_WORKER_TIMEOUT:-60}
+    healthcheck:
+      test: ["CMD-SHELL", "php -r 'exit(0);' && test -f /var/www/html/console.php || exit 1"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    depends_on:
+      staging-app:
+        condition: service_started
+      staging-redis:
+        condition: service_started
+    entrypoint: ""
+    stop_grace_period: 30s
+    secrets:
+      - db_user_password
+      - redis_password
+      - app_key
+      - vault_encryption_key
+
+  # Scheduler (Cron Jobs)
+  staging-scheduler:
+    image: git.michaelschiemer.de:5000/framework:latest
+    container_name: staging-scheduler
+    restart: unless-stopped
+    networks:
+      - staging-internal
+    environment:
+      - TZ=Europe/Berlin
+      - APP_ENV=staging
+      - APP_DEBUG=${APP_DEBUG:-true}
+      # Database
+      - DB_HOST=${DB_HOST:-postgres}
+      - DB_PORT=${DB_PORT:-5432}
+      - DB_DATABASE=${DB_DATABASE:-michaelschiemer_staging}
+      - DB_USERNAME=${DB_USERNAME}
+      - DB_PASSWORD=${DB_PASSWORD}
+      # Use Docker Secrets via *_FILE pattern (Framework supports this automatically)
+      - DB_PASSWORD_FILE=/run/secrets/db_user_password
+      # Redis
+      - REDIS_HOST=staging-redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
+    volumes:
+      - staging-code:/var/www/html
+      - staging-storage:/var/www/html/storage
+      - staging-logs:/var/www/html/storage/logs
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    command: php console.php scheduler:run
+    healthcheck:
+      test: ["CMD-SHELL", "php -r 'exit(0);' && test -f /var/www/html/console.php || exit 1"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    depends_on:
+      staging-app:
+        condition: service_started
+      staging-redis:
+        condition: service_started
+    entrypoint: ""
+    stop_grace_period: 30s
+    secrets:
+      - db_user_password
+      - redis_password
+      - app_key
+      - vault_encryption_key
+
+  # Remove base services that are not needed in staging
+  web:
+    profiles:
+      - never
+  php:
+    profiles:
+      - never
+  db:
+    profiles:
+      - never
+  redis:
+    profiles:
+      - never
+  queue-worker:
+    profiles:
+      - never
+  minio:
+    profiles:
+      - never
+
+networks:
+  traefik-public:
+    external: true
+  staging-internal:
+    driver: bridge
+
+volumes:
+  staging-code:
+    name: staging-code
+  staging-storage:
+    name: staging-storage
+  staging-logs:
+    name: staging-logs
+  staging-redis-data:
+    name: staging-redis-data
+