Add Gitea Actions CI/CD and production deploy scripts.

Wire typecheck/test on PR/push and SSH deploy to the foreign VPS on main.

.gitea/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Typecheck and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test

.gitea/workflows/deploy.yml

@@ -0,0 +1,67 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-telegram-relay
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Typecheck and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm test
+
+  deploy:
+    name: Deploy to VPS
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Deploy over SSH
+        env:
+          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+        run: |
+          set -euo pipefail
+          test -n "${SSH_KEY:-}"
+          test -n "${VPS_HOST:-}"
+          test -n "${VPS_USER:-}"
+
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq rsync openssh-client
+
+          install -m 700 -d "$HOME/.ssh"
+          printf '%s\n' "$SSH_KEY" > "$HOME/.ssh/deploy_key"
+          chmod 600 "$HOME/.ssh/deploy_key"
+
+          SSH=(ssh -i "$HOME/.ssh/deploy_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new)
+
+          "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" 'install -d -m 0750 /opt/ghabilee-telegram-relay'
+          rsync -az --delete \
+            -e "ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \
+            --exclude '.git' \
+            --exclude 'node_modules' \
+            --exclude 'dist' \
+            --exclude '.env' \
+            ./ "${VPS_USER}@${VPS_HOST}:/opt/ghabilee-telegram-relay/"
+
+          "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" \
+            'chmod +x /opt/ghabilee-telegram-relay/scripts/deploy-on-vps.sh && APP_DIR=/opt/ghabilee-telegram-relay /opt/ghabilee-telegram-relay/scripts/deploy-on-vps.sh'
+
+          rm -f "$HOME/.ssh/deploy_key"

README.md

@@ -76,6 +76,26 @@ cp .env.example .env
 docker compose up -d --build
 ```
 
+## CI/CD (Gitea Actions)
+
+On push to `main`:
+
+1. `.gitea/workflows/ci.yml` — typecheck + tests
+2. `.gitea/workflows/deploy.yml` — rsync to VPS + `scripts/deploy-on-vps.sh`
+
+Repo Actions secrets (Settings → Actions → Secrets):
+
+| Secret | Value |
+| ------ | ----- |
+| `DEPLOY_SSH_KEY` | private key that can SSH as `root` on the VPS |
+| `VPS_HOST` | `65.108.18.151` (public IP; job runs in Docker) |
+| `VPS_USER` | `root` |
+
+Production app dir: `/opt/ghabilee-telegram-relay`  
+Nginx host: `telegram-relay.ghabilee.ir` (add DNS A record, then `certbot --nginx -d telegram-relay.ghabilee.ir`)
+
+Gitea git SSH uses port **222**: `ssh://git@git.ghabilee.ir:222/AliSaZa/telegrambot.git`
+
 ## Env
 
 See [`.env.example`](.env.example). Production needs:

deploy/docker-compose.production.yml

@@ -0,0 +1,24 @@
+services:
+  telegram-relay:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: ghabilee-telegram-relay
+    restart: unless-stopped
+    env_file:
+      - .env
+    ports:
+      # Only localhost — Nginx terminates TLS in front.
+      - '127.0.0.1:3100:3100'
+    healthcheck:
+      test:
+        [
+          'CMD',
+          'node',
+          '-e',
+          "fetch('http://127.0.0.1:3100/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s

deploy/nginx/telegram-relay.conf

@@ -0,0 +1,18 @@
+# Telegram relay — TLS terminated by Nginx, app on 127.0.0.1:3100
+# DNS: point this hostname at 65.108.18.151, then:
+#   certbot --nginx -d telegram-relay.ghabilee.ir
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name telegram-relay.ghabilee.ir;
+
+    location / {
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

scripts/deploy-on-vps.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Deploy telegram relay on the VPS (idempotent).
+# Expects app files already present in APP_DIR (CI rsync or prior clone).
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/ghabilee-telegram-relay}"
+
+cd "$APP_DIR"
+
+install -m 0644 deploy/docker-compose.production.yml "$APP_DIR/docker-compose.yml"
+
+if [ ! -f "$APP_DIR/.env" ]; then
+  echo "Missing $APP_DIR/.env — copy from .env.example and fill secrets before serving traffic." >&2
+  cp .env.example "$APP_DIR/.env"
+  chmod 600 "$APP_DIR/.env"
+  echo "Created placeholder .env; edit it, then re-run deploy." >&2
+  exit 2
+fi
+
+docker compose -f "$APP_DIR/docker-compose.yml" build --pull
+docker compose -f "$APP_DIR/docker-compose.yml" up -d --remove-orphans
+
+install -m 0644 deploy/nginx/telegram-relay.conf /etc/nginx/sites-available/telegram-relay
+ln -sfn /etc/nginx/sites-available/telegram-relay /etc/nginx/sites-enabled/telegram-relay
+nginx -t
+systemctl reload nginx
+
+for attempt in $(seq 1 30); do
+  health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' ghabilee-telegram-relay 2>/dev/null || echo missing)"
+  echo "health ${attempt}/30: ${health}"
+  if [ "$health" = "healthy" ] || [ "$health" = "running" ]; then
+    curl -sf "http://127.0.0.1:3100/health" >/dev/null
+    echo "Deploy OK"
+    exit 0
+  fi
+  case "$health" in
+    unhealthy|exited|dead|missing) exit 1 ;;
+  esac
+  sleep 2
+done
+
+echo "Timed out waiting for healthy container" >&2
+exit 1