From c1bc9e1994d09c308937c2a5cf42e01a1c368001 Mon Sep 17 00:00:00 2001
From: parsa aghaei <p.aghaei@hoshmand.local>
Date: Sun, 9 Aug 2026 11:23:21 +0330
Subject: [PATCH] ci: fix runner setup, integrate nexus npm proxy and safe vpn
 wrapper

---
 .gitea/workflows/deploy.yml | 11 ++++++-----
 Dockerfile                  | 16 ++++++++++++++++
 backend/Dockerfile          |  9 +++++++++
 3 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 25954c0..3fb4444 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -8,8 +8,8 @@ on:
 
 jobs:
   deploy:
-    runs-on: canina
-    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Setup SSH key
         shell: sh
@@ -19,14 +19,15 @@ jobs:
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
+          # 172.17.0.1 = docker host from inside runner container
           ssh-keyscan -p 2234 -H 172.17.0.1 >> ~/.ssh/known_hosts
 
-      - name: Deploy with VPN for build
+      - name: Deploy via SSH (with VPN for docker build)
         shell: sh
-        timeout-minutes: 20
+        timeout-minutes: 28
         env:
           BRANCH: ${{ github.ref_name }}
         run: |
           echo "Deploying branch: ${BRANCH}"
           ssh -o StrictHostKeyChecking=no -p 2234 devops@172.17.0.1 \
-            "bash /opt/services/scripts/with-vpn.sh \"bash /opt/services/canina/deploy.sh ${BRANCH}\""
\ No newline at end of file
+            "sudo bash /opt/services/scripts/with-vpn.sh \"bash /opt/services/canina/deploy.sh ${BRANCH}\""
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 0878fa8..4610e43 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,14 @@ FROM node:20-alpine AS app-builder
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NEXT_PUBLIC_API_URL=https://api.canina.ir/api
+
+# Optional: Use Nexus as npm registry
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false; \
+    fi
+
 COPY frontend/application/package*.json ./
 RUN npm ci --include=dev --prefer-offline --no-audit
 COPY frontend/application ./
@@ -12,6 +20,14 @@ RUN npm run build
 FROM node:20-alpine AS admin-builder
 WORKDIR /app
 ENV VITE_API_URL=https://api.canina.ir/api
+
+# Optional: Use Nexus as npm registry (inherits build-arg)
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false; \
+    fi
+
 COPY frontend/admin-panel/package*.json ./
 RUN npm ci --include=dev --prefer-offline --no-audit
 COPY frontend/admin-panel ./
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 4de8dfc..0a6ce5b 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -1,6 +1,15 @@
 FROM node:20-alpine AS builder
 RUN apk add --no-cache openssl 2>/dev/null || true
 WORKDIR /app
+
+# Optional: Use Nexus as npm registry (pass --build-arg NPM_REGISTRY=http://nexus:8081/repository/npm/)
+ARG NPM_REGISTRY=
+RUN if [ -n "$NPM_REGISTRY" ]; then \
+        npm config set registry "$NPM_REGISTRY" && \
+        npm config set strict-ssl false && \
+        echo "Using npm registry: $NPM_REGISTRY"; \
+    fi
+
 COPY package*.json ./
 RUN npm ci --prefer-offline --no-audit
 COPY . .