# Branch protection / CI (Gitea)

## Architecture

| Role | Where |
| ---- | ----- |
| Git + Actions runner + Telegram notify | Finland (`git.ghabilee.ir`) |
| Admin runtime (`ghabilee-admin` container) | Iran VPS |

Build the image on Finland, stream it to Iran, then `docker compose up` there.

## Actions secrets

**Iran runtime (already set as `VPS_*`):**

| Secret | Meaning |
| ------ | ------- |
| `VPS_HOST` | Iran IP (e.g. `95.38.160.241`) |
| `VPS_USER` | usually `root` |
| `VPS_SSH_KEY` | Iran private key |

**Finland build host (required):**

| Secret | Meaning |
| ------ | ------- |
| `FINLAND_HOST` | e.g. `65.108.18.151` |
| `FINLAND_USER` | usually `root` |
| `FINLAND_SSH_KEY` | same key telegrambot uses as `DEPLOY_SSH_KEY` |

**Telegram (required — same values as telegrambot repo):**

| Secret | Meaning |
| ------ | ------- |
| `TELEGRAM_BOT_TOKEN` | bot token |
| `TELEGRAM_GROUP_CHAT_ID` | ops group |
| `TELEGRAM_GROUP_THREAD_ID` | forum topic id (optional) |
| `TELEGRAM_CHAT_ID` | private fallback (optional) |

## Manual notify test

Actions → **Notify Telegram (manual)** → Run workflow