ci: deploy native binary directly to LXC via SSH (drop Docker/registry)

Switch the runtime from a Docker image to a systemd service running the
native binary on the LXC host. The CI still uses Docker for the build
environment (maven:3.9.6-eclipse-temurin-21), but stops at producing the
static native binary.

Pipeline changes:
- Drop docker.io, docker-buildx, docker buildx, docker push, registry.
- Drop Dockerfile, compose.yaml, .dockerignore (no longer needed).
- Build native binary in CI container, SCP to LXC, run deploy script.
- Deploy script stops the service, swaps the binary, starts it, hits
  /q/health/live to verify.

LXC one-time setup (manual, run on the host):
- useradd runner (UID 1001)
- mkdir /opt/shot-crafter-calculator/{data,keys,deploy}
- copy RSA JWT keys into keys/
- install /etc/systemd/system/shot-crafter-calculator.service
- install /usr/local/bin/deploy-shot-crafter-calculator.sh
- useradd deployer + ssh keypair for the CI
- store DEPLOY_SSH_KEY secret in Gitea

Bootstrap the first deploy manually with scp + ssh before relying on CI.

.dockerignore

@@ -1,8 +0,0 @@
-.git
-target
-node_modules
-data
-.mvn
-*.md
-.gitignore
-.gitea

.gitea/workflows/ci.yml

@@ -21,18 +21,16 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, docker, buildx, and basic tools
+      - name: Install git, node, gcc, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev openssh-client
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
           git --version
           node --version
           gcc --version
-          docker --version
-          docker buildx version
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -64,48 +62,20 @@ jobs:
         run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
 
       - name: Verify native binary
-        run: |
-          ls -la target/shot-crafter-calculator-1.0.0-runner
+        run: ls -la target/shot-crafter-calculator-1.0.0-runner
 
-      - name: Stage binary for Docker
-        run: |
-          mkdir -p build-output
-          cp target/shot-crafter-calculator-1.0.0-runner build-output/
-          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
-          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
-
-      - name: Build & Push Docker image
+      - name: Deploy to LXC
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           set -e
-          echo "=== Build Docker image ==="
-          docker buildx build -t shot-crafter-calculator:ci .
-          echo "=== Login to Gitea Registry ==="
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.danielarroyo.cl -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
-          echo "=== Tag ==="
-          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
-          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}
-
-          push_with_retry() {
-            local ref="$1"
-            local attempt=1
-            local max_attempts=3
-            while [ $attempt -le $max_attempts ]; do
-              echo "=== Push (attempt $attempt/$max_attempts): $ref ==="
-              if docker push "$ref"; then
-                return 0
-              fi
-              echo "::warning::Push of $ref failed, retrying in 15s..."
-              sleep 15
-              attempt=$((attempt + 1))
-            done
-            echo "::error::Push of $ref failed after $max_attempts attempts"
-            return 1
-          }
-
-          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest"
-          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}"
-          echo "=== Logout ==="
-          docker logout gitea.danielarroyo.cl
-          echo "=== Done ==="
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 0600 ~/.ssh/deploy_key
+          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
+          ssh -i ~/.ssh/deploy_key deployer@localhost \
+            "mkdir -p /opt/shot-crafter-calculator/deploy"
+          scp -i ~/.ssh/deploy_key \
+            target/shot-crafter-calculator-1.0.0-runner \
+            deployer@localhost:/opt/shot-crafter-calculator/deploy/application
+          ssh -i ~/.ssh/deploy_key deployer@localhost \
+            "sudo /usr/local/bin/deploy-shot-crafter-calculator.sh"

Dockerfile

@@ -1,19 +0,0 @@
-FROM registry.access.redhat.com/ubi9/ubi-minimal AS curl-builder
-RUN microdnf install -y curl-minimal && microdnf clean all \
- && mkdir -p /out/etc/pki /out/etc \
- && install -D -m 0755 /usr/bin/curl /out/usr/bin/curl \
- && for lib in $(ldd /usr/bin/curl | awk '/=>/ {print $3}' | sort -u); do \
-      install -D -m 0755 "$lib" "/out$lib"; \
-    done \
- && cp -rP /etc/pki/ca-trust /out/etc/pki/ \
- && cp -rP /etc/ssl /out/etc/
-
-FROM quay.io/quarkus/quarkus-micro-image:2.0
-WORKDIR /work/
-COPY --chown=1001:1001 build-output/shot-crafter-calculator-1.0.0-runner /work/application
-COPY --from=curl-builder /out/ /
-
-EXPOSE 8080
-USER 1001
-
-ENTRYPOINT ["./application"]

compose.yaml

@@ -1,57 +0,0 @@
-# shot-crafter-calculator — Docker Compose
-#
-# Instalacion basica:
-#   docker compose pull          # descarga la imagen :latest
-#   docker compose up -d         # arranca en background
-#   docker compose logs -f       # ver logs
-#   docker compose down          # parar (los datos quedan en el volumen)
-#   docker compose down -v       # parar y BORRAR volumen (pierde la DB)
-#
-# Ver la DB H2:
-#   docker compose exec shot-crafter ls -la /work/data
-#   docker compose exec shot-crafter cat /work/data/shots.trace.db  # logs SQL
-#
-# Personalizacion via env vars (override con `docker compose run -e KEY=value`
-# o definiendolas en un .env al lado de este archivo):
-#   - QUARKUS_DATASOURCE_JDBC_URL  ruta de la DB (default: /work/data/shots.mv.db)
-#   - QUARKUS_HTTP_PORT            puerto (default: 8080)
-#   - QUARKUS_HTTP_HOST            bind interface (default: 0.0.0.0)
-#   - APP_AUTH_COOKIE_SECURE       'true' si va detras de HTTPS
-#   - APP_AUTH_COOKIE_NAME         nombre de la cookie
-#   - MP_JWT_VERIFY_PUBLICKEY_LOCATION      ruta a la clave publica RSA
-#   - SMALLRYE_JWT_SIGN_KEY_LOCATION       ruta a la clave privada RSA
-#
-# Ver .env.example para la lista completa.
-#
-# Pin a version especifica (recomendado en produccion):
-#   image: gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:1.0.0
-#   o
-#   docker compose pull gitea.danielarroyo.cl/proyectos/shot-crafter-calculator@sha256:...
-
-services:
-  shot-crafter:
-    image: gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
-    container_name: shot-crafter
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    environment:
-      QUARKUS_HTTP_HOST: 0.0.0.0
-      QUARKUS_HTTP_PORT: 8080
-      QUARKUS_DATASOURCE_JDBC_URL: jdbc:h2:file:/work/data/shots;DB_CLOSE_DELAY=-1
-      APP_AUTH_COOKIE_SECURE: "false"
-      APP_AUTH_COOKIE_NAME: auth-token
-    volumes:
-      - shot-crafter-data:/work/data
-    healthcheck:
-      # curl contra /q/health/live (extension quarkus-smallrye-health).
-      # Devuelve 200 si la app esta viva. -f falla si el status != 2xx.
-      test: ["CMD", "curl", "-fsS", "--max-time", "5", "http://localhost:8080/q/health/live"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  shot-crafter-data:
-    name: shot-crafter-data