From f6bc7129d05924efe46a8b0f486cf97e3898dbde Mon Sep 17 00:00:00 2001
From: bast <bast@bast.li>
Date: Sun, 1 Nov 2026 00:48:15 +0000
Subject: [PATCH] =?UTF-8?q?.github/workflows/deploy.yml=20hinzugef=C3=BCgt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/deploy.yml | 61 ++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/deploy.yml

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..c014649
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,61 @@
+name: Django Helm GitOps Deploy
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Activate Included Terraform Binary
+        run: |
+          mv ./terraform /usr/local/bin/terraform 2>/dev/null || echo "Nutze vorhandenes File"
+          chmod +x /usr/local/bin/terraform
+          terraform --version
+
+      - name: Trust Local Nginx Certificate Inside Container
+        run: |
+          mkdir -p /usr/local/share/ca-certificates/
+          cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
+          update-ca-certificates
+
+      # Nutzt dein Personal Access Token für den Registry-Push über den Host-Socket
+      - name: Log in to Local Registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3005 -u ${{ github.actor }} --password-stdin
+
+      # Baut das Django-Image und taggt es mit dem aktuellen Git-SHA
+      - name: Build Django Image
+        run: |
+          docker build -t registry.local/bast/boday-it-web:${{ github.sha }} .
+          docker build -t registry.local/bast/boday-it-web:latest .
+
+      # Pusht das Image hochsicher via HTTPS über das Nginx-Tor
+      - name: Push Django Image
+        run: |
+          docker push registry.local/bast/boday-it-web:${{ github.sha }}
+          docker push registry.local/bast/boday-it-web:latest
+
+      # Bereitet den Kubernetes-Zugang über das automatische Secret vor
+      - name: Prepare Kubernetes Access
+        run: |
+          echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
+          chmod 600 ./kind_kubeconfig
+
+      # Das grosse Finale: Rollout des kompletten Helm-Charts
+      - name: Terraform Deploy
+        run: |
+          terraform init
+          terraform apply -auto-approve -var="app_version=${{ github.sha }}"
+
+      - name: Verify App Health
+        run: |
+          echo "Warte auf die Django-Pods und das Ingress-Routing..."
+          sleep 20
+          curl --fail --connect-timeout 5 http://local-k3s-platform:80/ || exit 1
+          echo "Erfolg: Die Boday-IT Django-Webseite läuft perfekt via Helm!"