ci: fix runner setup, integrate nexus npm proxy and safe vpn wrapper

.gitea/workflows/deploy.yml

@@ -8,8 +8,8 @@ on:
 
 jobs:
   deploy:
-    runs-on: canina
-    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Setup SSH key
         shell: sh
@@ -19,14 +19,15 @@ jobs:
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
+          # 172.17.0.1 = docker host from inside runner container
           ssh-keyscan -p 2234 -H 172.17.0.1 >> ~/.ssh/known_hosts
 
-      - name: Deploy with VPN for build
+      - name: Deploy via SSH (with VPN for docker build)
         shell: sh
-        timeout-minutes: 20
+        timeout-minutes: 28
         env:
           BRANCH: ${{ github.ref_name }}
         run: |
           echo "Deploying branch: ${BRANCH}"
           ssh -o StrictHostKeyChecking=no -p 2234 devops@172.17.0.1 \
-            "bash /opt/services/scripts/with-vpn.sh \"bash /opt/services/canina/deploy.sh ${BRANCH}\""
+            "sudo bash /opt/services/scripts/with-vpn.sh \"bash /opt/services/canina/deploy.sh ${BRANCH}\""

Dockerfile

@@ -2,6 +2,14 @@ FROM node:20-alpine AS app-builder
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NEXT_PUBLIC_API_URL=https://api.canina.ir/api
+
+# Optional: Use Nexus as npm registry
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false; \
+    fi
+
 COPY frontend/application/package*.json ./
 RUN npm ci --include=dev --prefer-offline --no-audit
 COPY frontend/application ./
@@ -12,6 +20,14 @@ RUN npm run build
 FROM node:20-alpine AS admin-builder
 WORKDIR /app
 ENV VITE_API_URL=https://api.canina.ir/api
+
+# Optional: Use Nexus as npm registry (inherits build-arg)
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false; \
+    fi
+
 COPY frontend/admin-panel/package*.json ./
 RUN npm ci --include=dev --prefer-offline --no-audit
 COPY frontend/admin-panel ./

backend/Dockerfile

@@ -1,6 +1,15 @@
 FROM node:20-alpine AS builder
 RUN apk add --no-cache openssl 2>/dev/null || true
 WORKDIR /app
+
+# Optional: Use Nexus as npm registry (pass --build-arg NPM_REGISTRY=http://nexus:8081/repository/npm/)
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false && \
+        echo "Using npm registry: $NPM_REGISTRY"; \
+    fi
+
 COPY package*.json ./
 RUN npm ci --prefer-offline --no-audit
 COPY . .