refactor(ci): remove automated deploy, add manual deploy.sh

CI now only builds + pushes images to GitLab Container Registry.
Deploy is done manually via deploy.sh with specific SHA tag support.

Usage: ./deploy.sh [sha]  # default: latest

deploy.sh

@@ -1,49 +1,75 @@
 #!/bin/bash
+# ─── Bete Manual Deploy Script ───────────────────────────────────────────────
+# Pulls Docker images from GitLab Container Registry and restarts containers.
+#
+# Usage:
+#   ./deploy.sh                 # deploy :latest
+#   ./deploy.sh <sha>           # deploy specific commit SHA
+#   ./deploy.sh --help          # show this help
+#
+# Required env:
+#   VPS_HOST        — VPS IP/hostname
+#   VPS_USER        — SSH user
+#   VPS_SSH_KEY     — path to SSH private key
+#   GITLAB_TOKEN    — GitLab Personal Access Token (for docker login)
+#
+# Optional env:
+#   APP_DIR         — app directory on VPS (default: /opt/imphenbot)
+#   GITLAB_USER     — GitLab username (default: gitlab-ci-token)
+#   REGISTRY        — container registry (default: registry.gitlab.com)
+#   COMPOSE_FILE    — path relative to APP_DIR (default: infra/docker/docker-compose.yml)
+# ──────────────────────────────────────────────────────────────────────────────
 
-# Configuration for CLI deployment
-VPS_HOST="45.127.35.244"
-VPS_USER="root"
-# Find first available private key in ~/.ssh or use specific one if you want to hardcode
-SSH_KEY_PATH=$(find ~/.ssh -name "id_rsa" -o -name "id_ed25519" | head -n 1)
+set -eu
 
-echo "🚀 Starting CLI deployment to $VPS_USER@$VPS_HOST..."
-
-if [ -z "$SSH_KEY_PATH" ]; then
-  echo "⚠️ No SSH key found in ~/.ssh. Falling back to default SSH behavior."
-  SSH_CMD="ssh -o StrictHostKeyChecking=no $VPS_USER@$VPS_HOST"
-  RSYNC_CMD="rsync -avz --exclude-from='.dockerignore' -e 'ssh -o StrictHostKeyChecking=no'"
-else
-  echo "🔑 Using SSH key: $SSH_KEY_PATH"
-  SSH_CMD="ssh -i $SSH_KEY_PATH -o StrictHostKeyChecking=no $VPS_USER@$VPS_HOST"
-  RSYNC_CMD="rsync -avz --exclude-from='.dockerignore' -e 'ssh -i $SSH_KEY_PATH -o StrictHostKeyChecking=no'"
+if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
+  sed -n '2,/^$/ s/^# //p' "$0"
+  exit 0
 fi
 
-# Directory on the VPS where the app will be deployed
-REMOTE_DIR="/opt/imphenbot"
+# ── Config ────────────────────────────────────────────────────────────────────
+IMAGE_TAG="${1:-latest}"
+APP_DIR="${APP_DIR:-/opt/imphenbot}"
+COMPOSE_FILE="${COMPOSE_FILE:-infra/docker/docker-compose.yml}"
+REGISTRY="${REGISTRY:-registry.gitlab.com}"
+GITLAB_USER="${GITLAB_USER:-gitlab-ci-token}"
 
-echo "📦 Syncing files to VPS..."
-$SSH_CMD "mkdir -p $REMOTE_DIR"
-eval "$RSYNC_CMD ./ $VPS_USER@$VPS_HOST:$REMOTE_DIR"
+# ── Required vars ─────────────────────────────────────────────────────────────
+: "${VPS_HOST:?Required: VPS_HOST}"
+: "${VPS_USER:?Required: VPS_USER}"
+: "${VPS_SSH_KEY:?Required: VPS_SSH_KEY}"
+: "${GITLAB_TOKEN:?Required: GITLAB_TOKEN}"
 
-if [ -f .env ]; then
-  echo "🔒 Copying local .env to VPS..."
-  if [ -z "$SSH_KEY_PATH" ]; then
-    scp -o StrictHostKeyChecking=no .env $VPS_USER@$VPS_HOST:$REMOTE_DIR/.env
-  else
-    scp -i $SSH_KEY_PATH -o StrictHostKeyChecking=no .env $VPS_USER@$VPS_HOST:$REMOTE_DIR/.env
-  fi
-else
-  echo "⚠️ No local .env found to copy."
-fi
+SSH_DEST="${VPS_USER}@${VPS_HOST}"
 
-echo "🔄 Rebuilding and restarting Docker containers..."
-$SSH_CMD << EOF
-  cd $REMOTE_DIR
-  if command -v docker-compose &> /dev/null; then
-    docker-compose up -d --build
-  else
-    docker compose up -d --build
-  fi
-EOF
+# ── Helper: run command on VPS ────────────────────────────────────────────────
+vps() {
+  ssh -i "$VPS_SSH_KEY" -o StrictHostKeyChecking=accept-new "$SSH_DEST" "$@"
+}
 
-echo "✅ Deployment complete!"
+# ── Steps ─────────────────────────────────────────────────────────────────────
+echo "→ Deploying tag: ${IMAGE_TAG}"
+echo "→ Target:         ${SSH_DEST}:${APP_DIR}"
+echo ""
+
+echo "→ Copying ${COMPOSE_FILE} to VPS..."
+scp -i "$VPS_SSH_KEY" -o StrictHostKeyChecking=accept-new \
+  "$COMPOSE_FILE" "${SSH_DEST}:${APP_DIR}/${COMPOSE_FILE}"
+
+echo "→ Logging in to GitLab Container Registry..."
+vps "echo '${GITLAB_TOKEN}' | docker login ${REGISTRY} -u '${GITLAB_USER}' --password-stdin"
+
+echo "→ Pulling images (tag: ${IMAGE_TAG})..."
+vps "cd ${APP_DIR} && IMAGE_TAG=${IMAGE_TAG} docker compose -f ${COMPOSE_FILE} pull"
+
+echo "→ Restarting containers..."
+vps "cd ${APP_DIR} && IMAGE_TAG=${IMAGE_TAG} docker compose -f ${COMPOSE_FILE} up -d --remove-orphans"
+
+echo "→ Restarting proxy (nginx upstream DNS refresh)..."
+vps "cd ${APP_DIR} && IMAGE_TAG=${IMAGE_TAG} docker compose -f ${COMPOSE_FILE} restart proxy"
+
+echo "→ Cleaning up old images..."
+vps "docker image prune -f"
+
+echo ""
+echo "✓ Deploy complete (tag: ${IMAGE_TAG})"