ci: revert to Docker image build + registry push (no deploy)

Drop the LXC deploy step. Pipeline now stops at publishing the image
to the Gitea registry; deployment is handled out of band.

Restored:
- Dockerfile (multi-stage: curl-builder + quarkus-micro-image:2.0,
  generic via build-output/*-runner wildcard, COPY --chown=1001:1001)
- compose.yaml (one-shot install of the published image)
- .dockerignore (excludes build-output/)

CI workflow:
- Installs docker-buildx (needed for COPY --chown)
- Uses docker buildx build
- chmod 775 and echo securerandom happen in the 'Stage binary for Docker'
  step; the final image has no RUN commands
- Tags :latest and :<short-sha>, pushes with retry

No deploy step. Pull the image with docker compose / run it manually.

.dockerignore

@@ -0,0 +1,9 @@
+.git
+target
+node_modules
+data
+.mvn
+*.md
+.gitignore
+.gitea
+build-output

.gitea/workflows/ci.yml

@@ -21,16 +21,18 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, and basic tools
+      - name: Install git, node, gcc, docker, buildx, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev openssh-client
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
           git --version
           node --version
           gcc --version
+          docker --version
+          docker buildx version
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,20 +64,48 @@ jobs:
         run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
 
       - name: Verify native binary
-        run: ls -la target/shot-crafter-calculator-1.0.0-runner
+        run: |
+          ls -la target/shot-crafter-calculator-1.0.0-runner
 
-      - name: Deploy to LXC
+      - name: Stage binary for Docker
+        run: |
+          mkdir -p build-output
+          cp target/shot-crafter-calculator-1.0.0-runner build-output/
+          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
+          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
+
+      - name: Build & Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           set -e
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
-          chmod 0600 ~/.ssh/deploy_key
-          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
-          ssh -i ~/.ssh/deploy_key deployer@localhost \
-            "mkdir -p /opt/shot-crafter-calculator/deploy"
-          scp -i ~/.ssh/deploy_key \
-            target/shot-crafter-calculator-1.0.0-runner \
-            deployer@localhost:/opt/shot-crafter-calculator/deploy/application
-          ssh -i ~/.ssh/deploy_key deployer@localhost \
-            "sudo /usr/local/bin/deploy-shot-crafter-calculator.sh"
+          echo "=== Build Docker image ==="
+          docker buildx build -t shot-crafter-calculator:ci .
+          echo "=== Login to Gitea Registry ==="
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.danielarroyo.cl -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
+          echo "=== Tag ==="
+          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
+          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}
+
+          push_with_retry() {
+            local ref="$1"
+            local attempt=1
+            local max_attempts=3
+            while [ $attempt -le $max_attempts ]; do
+              echo "=== Push (attempt $attempt/$max_attempts): $ref ==="
+              if docker push "$ref"; then
+                return 0
+              fi
+              echo "::warning::Push of $ref failed, retrying in 15s..."
+              sleep 15
+              attempt=$((attempt + 1))
+            done
+            echo "::error::Push of $ref failed after $max_attempts attempts"
+            return 1
+          }
+
+          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest"
+          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}"
+          echo "=== Logout ==="
+          docker logout gitea.danielarroyo.cl
+          echo "=== Done ==="

Dockerfile

@@ -0,0 +1,19 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal AS curl-builder
+RUN microdnf install -y curl-minimal && microdnf clean all \
+ && mkdir -p /out/etc/pki /out/etc \
+ && install -D -m 0755 /usr/bin/curl /out/usr/bin/curl \
+ && for lib in $(ldd /usr/bin/curl | awk '/=>/ {print $3}' | sort -u); do \
+      install -D -m 0755 "$lib" "/out$lib"; \
+    done \
+ && cp -rP /etc/pki/ca-trust /out/etc/pki/ \
+ && cp -rP /etc/ssl /out/etc/
+
+FROM quay.io/quarkus/quarkus-micro-image:2.0
+WORKDIR /work/
+COPY --chown=1001:1001 build-output/*-runner /work/application
+COPY --from=curl-builder /out/ /
+
+EXPOSE 8080
+USER 1001
+
+ENTRYPOINT ["./application"]

compose.yaml

@@ -0,0 +1,25 @@
+services:
+  shot-crafter:
+    image: gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
+    container_name: shot-crafter
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      QUARKUS_HTTP_HOST: 0.0.0.0
+      QUARKUS_HTTP_PORT: 8080
+      QUARKUS_DATASOURCE_JDBC_URL: jdbc:h2:file:/work/data/shots;DB_CLOSE_DELAY=-1
+      APP_AUTH_COOKIE_SECURE: "false"
+      APP_AUTH_COOKIE_NAME: auth-token
+    volumes:
+      - shot-crafter-data:/work/data
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "--max-time", "5", "http://localhost:8080/q/health/live"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+
+volumes:
+  shot-crafter-data:
+    name: shot-crafter-data