ci: migrate from GitHub Actions to GitLab CI/CD

- Create .gitlab-ci.yml with Docker build + GitLab registry push + VPS deploy
- 4 build jobs (frontend, backend, discord-gateway, proxy) in parallel
- Uses Docker-in-Docker with BuildKit for cached multi-stage builds
- Deploy stage uses SCP for .env + docker-compose, then SSH for orchestration
- Images pushed to registry.gitlab.com/mytheclipse-group/gmw/

GitLab CI/CD secrets configured:
  - VPS_HOST: 45.127.35.244
  - VPS_USERNAME: root
  - VPS_SSH_KEY: (file type - SSH private key)
  - ENV_FILE: (env_var type - full .env content)

Remove old .github/workflows/deploy-docker.yml (GitHub Actions)

.github/workflows/deploy-docker.yml

@@ -1,134 +0,0 @@
-name: Deploy to VPS
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-# Prevent concurrent deployments from racing
-concurrency:
-  group: deploy-vps-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  REGISTRY: ghcr.io
-  OWNER: mytheclipse
-
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      max-parallel: 2
-      matrix:
-        service: [frontend, backend, discord-gateway, proxy]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push ${{ matrix.service }}
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: infra/docker/Dockerfile.${{ matrix.service }}
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:latest
-            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:${{ github.sha }}
-          cache-from: type=gha,scope=bete-${{ matrix.service }}
-          cache-to: type=gha,mode=max,scope=bete-${{ matrix.service }}
-          build-args: |
-            VITE_BE_API_URL=https://imphnen.asepharyana.my.id
-            VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id
-
-  deploy:
-    needs: build-and-push
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/master'
-    steps:
-      - name: Deploy to VPS
-        uses: appleboy/ssh-action@v1.2.5
-        env:
-          GHCR_USERNAME: ${{ github.actor }}
-          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ENV_FILE: ${{ secrets.ENV_FILE }}
-        with:
-          host: ${{ secrets.VPS_HOST }}
-          username: ${{ secrets.VPS_USERNAME }}
-          key: ${{ secrets.VPS_SSH_KEY }}
-          envs: GHCR_USERNAME,GHCR_TOKEN,ENV_FILE
-          script: |
-            set -eu
-
-            APP_DIR=/opt/imphenbot
-            REPO_URL=https://github.com/MythEclipse/GMW.git
-
-            if [ -d "$APP_DIR/.git" ]; then
-              ORIGIN=$(git -C "$APP_DIR" remote get-url origin 2>/dev/null || true)
-              if [ "$ORIGIN" != "$REPO_URL" ]; then
-                rm -rf "$APP_DIR"
-              fi
-            fi
-
-            if [ ! -d "$APP_DIR/.git" ]; then
-              mkdir -p "$APP_DIR"
-              git clone --depth 1 --branch master "$REPO_URL" "$APP_DIR"
-            else
-              git -C "$APP_DIR" fetch --depth 1 origin master
-              git -C "$APP_DIR" checkout master
-              git -C "$APP_DIR" reset --hard origin/master
-            fi
-
-            cd "$APP_DIR"
-
-            mkdir -p infra/docker/recordings
-            # Set permissions for recordings directory (writable by container app user UID 100)
-            chmod -R 777 infra/docker/recordings
-
-            # Write env file — strip \r to avoid configuration issues
-            printf '%s\n' "$ENV_FILE" | tr -d '\r' > infra/docker/.env
-
-            echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
-
-            # Force stop any stale containers from previous deployments
-            docker rm -f imphenbot-proxy imphenbot-backend imphenbot-frontend imphenbot-discord-gateway 2>/dev/null || true
-
-            # Retry docker pull up to 3 times on transient network errors
-            RETRIES=3
-            for i in $(seq 1 $RETRIES); do
-              echo "docker compose pull (attempt $i/$RETRIES)"
-              if docker compose -f infra/docker/docker-compose.yml pull; then
-                echo "Pull succeeded"
-                break
-              else
-                echo "Pull failed (attempt $i/$RETRIES)"
-                if [ "$i" -eq "$RETRIES" ]; then
-                  echo "All pull attempts failed" >&2
-                  exit 1
-                fi
-                sleep 5
-              fi
-            done
-
-            # Remove orphan containers but don't block on healthchecks —
-            # containers have restart: unless-stopped and will recover on their own
-            docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
-            docker image prune -f

.gitlab-ci.yml

@@ -0,0 +1,159 @@
+# ─── BETE GitLab CI/CD Pipeline ───────────────────────────────────────────────
+# Builds 4 Docker images (frontend, backend, discord-gateway, proxy),
+# pushes to GitLab Container Registry, then deploys to VPS via SSH.
+#
+# Required CI/CD Variables (set in GitLab → Settings → CI/CD → Variables):
+#
+#   VPS_HOST        - VPS IP/hostname
+#   VPS_USERNAME    - SSH user
+#   VPS_SSH_KEY     - SSH private key (type: file)
+#   ENV_FILE        - Full .env file content (type: env_var)
+#
+# Notes:
+#   - VPS_SSH_KEY must be "File" type so GitLab writes it to disk
+#   - ENV_FILE is "Variable" type — contains full multi-line .env content
+#
+# ──────────────────────────────────────────────────────────────────────────────
+
+stages:
+  - build
+  - deploy
+
+variables:
+  # Use Docker-in-Docker for building with BuildKit
+  DOCKER_HOST: tcp://docker:2376
+  DOCKER_TLS_CERTDIR: "/certs"
+  DOCKER_DRIVER: overlay2
+  DOCKER_BUILDKIT: 1
+
+  # Image naming
+  REGISTRY: $CI_REGISTRY
+  IMAGE_TAG_LATEST: latest
+  IMAGE_TAG_COMMIT: $CI_COMMIT_SHA
+
+  # Frontend build args
+  VITE_BE_API_URL: https://imphnen.asepharyana.my.id
+  VITE_BE_WS_URL: wss://imphnen.asepharyana.my.id
+
+  # Deploy defaults
+  SSH_HOST: "${VPS_USERNAME:-root}@${VPS_HOST:-45.127.35.244}"
+  APP_DIR: /opt/imphenbot
+
+# ── Build stage ───────────────────────────────────────────────────────────────
+.docker-build:
+  stage: build
+  image: docker:27-cli
+  tags:
+    - docker
+  services:
+    - name: docker:27-dind
+      command: ["--mtu=1400"]
+  cache:
+    key: docker-$CI_COMMIT_REF_SLUG-$SERVICE_NAME
+    paths:
+      - /caches/$SERVICE_NAME/
+  before_script:
+    # Login to GitLab Container Registry
+    - echo "$CI_JOB_TOKEN" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
+    # Ensure cache directory exists
+    - mkdir -p /caches/$SERVICE_NAME
+  script:
+    # Build with cache
+    - |
+      docker build \
+        --file infra/docker/Dockerfile.$SERVICE_NAME \
+        --tag $REGISTRY/$CI_PROJECT_PATH/bete-$SERVICE_NAME:$IMAGE_TAG_COMMIT \
+        --tag $REGISTRY/$CI_PROJECT_PATH/bete-$SERVICE_NAME:$IMAGE_TAG_LATEST \
+        --build-arg BUILDKIT_INLINE_CACHE=1 \
+        --build-arg VITE_BE_API_URL=$VITE_BE_API_URL \
+        --build-arg VITE_BE_WS_URL=$VITE_BE_WS_URL \
+        --cache-from $REGISTRY/$CI_PROJECT_PATH/bete-$SERVICE_NAME:latest \
+        .
+    # Push images
+    - docker push $REGISTRY/$CI_PROJECT_PATH/bete-$SERVICE_NAME:$IMAGE_TAG_COMMIT
+    - docker push $REGISTRY/$CI_PROJECT_PATH/bete-$SERVICE_NAME:$IMAGE_TAG_LATEST
+
+build-frontend:
+  extends: .docker-build
+  variables:
+    SERVICE_NAME: frontend
+  only:
+    - master
+
+build-backend:
+  extends: .docker-build
+  variables:
+    SERVICE_NAME: backend
+  only:
+    - master
+
+build-discord-gateway:
+  extends: .docker-build
+  variables:
+    SERVICE_NAME: discord-gateway
+  only:
+    - master
+
+build-proxy:
+  extends: .docker-build
+  variables:
+    SERVICE_NAME: proxy
+  only:
+    - master
+
+# ── Deploy stage ──────────────────────────────────────────────────────────────
+deploy-vps:
+  stage: deploy
+  image: alpine:latest
+  tags:
+    - docker
+  only:
+    - master
+  needs:
+    - build-frontend
+    - build-backend
+    - build-discord-gateway
+    - build-proxy
+  before_script:
+    # Install SSH client and tools
+    - apk add --no-cache openssh-client docker-compose bash
+    # Set up SSH key (file-type variable: value is a path)
+    - mkdir -p ~/.ssh
+    - cp "$VPS_SSH_KEY" ~/.ssh/id_rsa
+    - chmod 600 ~/.ssh/id_rsa
+    # Write .env content to temp file for scp
+    - printf '%s' "$ENV_FILE" > /tmp/.env.prod
+    # Add VPS to known_hosts
+    - ssh-keyscan -H "${VPS_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+  script:
+    # Copy .env and docker-compose to VPS
+    - scp /tmp/.env.prod "$SSH_HOST:$APP_DIR/.env"
+    - scp infra/docker/docker-compose.yml "$SSH_HOST:$APP_DIR/docker-compose.yml"
+    # Deploy via SSH
+    - |
+      ssh "$SSH_HOST" "
+        set -eu
+
+        cd $APP_DIR
+
+        # Login to GitLab Container Registry
+        echo '$CI_JOB_TOKEN' | docker login $CI_REGISTRY -u '$CI_REGISTRY_USER' --password-stdin
+
+        # Update image tags in docker-compose.yml to use GitLab registry
+        sed -i 's|ghcr.io/\${OWNER:-mytheclipse}|$CI_REGISTRY/$CI_PROJECT_PATH|g' docker-compose.yml
+        sed -i 's|\${OWNER:-mytheclipse}|$CI_PROJECT_NAMESPACE|g' docker-compose.yml
+
+        # Pull latest images
+        docker compose pull
+
+        # Stop and remove old containers
+        docker rm -f imphenbot-proxy imphenbot-backend imphenbot-frontend imphenbot-discord-gateway 2>/dev/null || true
+
+        # Start fresh
+        docker compose up -d --remove-orphans
+
+        # Cleanup old images
+        docker image prune -f
+      "
+  after_script:
+    - rm -f ~/.ssh/id_rsa /tmp/.env.prod