ci: auto-deploy on push to main + remove redundant API token (Authelia is auth layer)

.gitea/workflows/deploy.yml

@@ -0,0 +1,49 @@
+name: Deploy t-youtube
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'backend/**'
+      - 'frontend/**'
+      - 'Dockerfile'
+      - '.gitea/workflows/deploy.yml'
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    name: Build & Deploy
+    runs-on: nas
+    steps:
+      - name: Checkout
+        run: |
+          cd /volume1/docker/t-youtube
+          git pull origin main 2>&1
+
+      - name: Build Docker image
+        run: |
+          cd /volume1/docker/t-youtube
+          /volume1/@appstore/ContainerManager/usr/bin/docker build -t t-youtube:latest . 2>&1
+
+      - name: Swap container
+        run: |
+          D=/volume1/@appstore/ContainerManager/usr/bin
+          $D/docker stop t-youtube 2>/dev/null || true
+          $D/docker rm t-youtube 2>/dev/null || true
+          $D/docker run -d --name t-youtube --restart unless-stopped \
+            -p 8001:8000 \
+            --env-file /volume1/docker/t-youtube/.env \
+            -v /volume1/docker/t-youtube/data:/app/data \
+            -v /volume1/docker/t-youtube/config:/app/config \
+            t-youtube:latest 2>&1
+
+      - name: Verify
+        run: |
+          sleep 3
+          D=/volume1/@appstore/ContainerManager/usr/bin
+          STATUS=$($D/docker ps --filter name=t-youtube --format "{{.Status}}")
+          echo "Container: $STATUS"
+          if ! echo "$STATUS" | grep -q "Up"; then
+            echo "Container failed to start"
+            $D/docker logs t-youtube --tail 20
+            exit 1
+          fi

backend/main.py

@@ -29,8 +29,8 @@ app.add_middleware(
 
 )
 
-# API token validation for write operations
-API_TOKEN=os.environ.get('API_TOKEN', '')
+# API token validation — disabled. Authelia (Caddy forward_auth) handles auth upstream.
+API_TOKEN=""
 
 async def validate_api_token(request: Request, call_next):
     path = request.url.path