ci: setup CI/CD pipeline with Gitea Actions and secrets configuration

.gitea/workflows/update-production-secrets.yml

@@ -0,0 +1,74 @@
+name: Update Production Secrets
+
+on:
+  workflow_dispatch:
+    inputs:
+      vault_password:
+        description: 'Ansible Vault Password'
+        required: true
+        type: password
+
+env:
+  DEPLOYMENT_HOST: 94.16.110.151
+
+jobs:
+  deploy-secrets:
+    name: Deploy Secrets to Production
+    runs-on: ubuntu-latest
+    environment:
+      name: production-secrets
+      url: https://michaelschiemer.de
+
+    steps:
+      - name: Checkout deployment configuration
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            deployment/ansible
+          sparse-checkout-cone-mode: false
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/production
+          chmod 600 ~/.ssh/production
+          ssh-keyscan -H ${{ env.DEPLOYMENT_HOST }} >> ~/.ssh/known_hosts
+
+      - name: Install Ansible
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ansible
+
+      - name: Create vault password file
+        run: |
+          echo "${{ github.event.inputs.vault_password }}" > /tmp/.vault_pass
+          chmod 600 /tmp/.vault_pass
+
+      - name: Deploy secrets via Ansible
+        run: |
+          cd deployment/ansible
+          ansible-playbook -i inventory/production.yml \
+            playbooks/setup-production-secrets.yml \
+            --vault-password-file /tmp/.vault_pass
+
+      - name: Cleanup vault password
+        if: always()
+        run: |
+          rm -f /tmp/.vault_pass
+
+      - name: Verify secrets deployment
+        run: |
+          ssh -i ~/.ssh/production deploy@${{ env.DEPLOYMENT_HOST }} \
+            "docker secret ls && test -f /home/deploy/secrets/.env.production"
+
+      - name: Notify deployment success
+        if: success()
+        run: |
+          echo "✅ Secrets deployed successfully to production"
+          echo "Services will be restarted automatically"
+
+      - name: Notify deployment failure
+        if: failure()
+        run: |
+          echo "❌ Secrets deployment failed"
+          echo "Check Ansible logs for details"