From a2fad2a6e19d1ee2e0d89f4f8032905056e5261a Mon Sep 17 00:00:00 2001
From: "Gan, Jimmy" <jimmy.gan@adidas.com>
Date: Thu, 9 Jul 2026 22:55:10 +0800
Subject: [PATCH] ci: auto-deploy on push to main + remove redundant API token
 (Authelia is auth layer)

---
 .gitea/workflows/deploy.yml | 49 +++++++++++++++++++++++++++++++++++++
 backend/main.py             |  4 +--
 2 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 .gitea/workflows/deploy.yml

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..90de609
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,49 @@
+name: Deploy t-youtube
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'backend/**'
+      - 'frontend/**'
+      - 'Dockerfile'
+      - '.gitea/workflows/deploy.yml'
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    name: Build & Deploy
+    runs-on: nas
+    steps:
+      - name: Checkout
+        run: |
+          cd /volume1/docker/t-youtube
+          git pull origin main 2>&1
+
+      - name: Build Docker image
+        run: |
+          cd /volume1/docker/t-youtube
+          /volume1/@appstore/ContainerManager/usr/bin/docker build -t t-youtube:latest . 2>&1
+
+      - name: Swap container
+        run: |
+          D=/volume1/@appstore/ContainerManager/usr/bin
+          $D/docker stop t-youtube 2>/dev/null || true
+          $D/docker rm t-youtube 2>/dev/null || true
+          $D/docker run -d --name t-youtube --restart unless-stopped \
+            -p 8001:8000 \
+            --env-file /volume1/docker/t-youtube/.env \
+            -v /volume1/docker/t-youtube/data:/app/data \
+            -v /volume1/docker/t-youtube/config:/app/config \
+            t-youtube:latest 2>&1
+
+      - name: Verify
+        run: |
+          sleep 3
+          D=/volume1/@appstore/ContainerManager/usr/bin
+          STATUS=$($D/docker ps --filter name=t-youtube --format "{{.Status}}")
+          echo "Container: $STATUS"
+          if ! echo "$STATUS" | grep -q "Up"; then
+            echo "Container failed to start"
+            $D/docker logs t-youtube --tail 20
+            exit 1
+          fi
diff --git a/backend/main.py b/backend/main.py
index 9f42705..e09511e 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -29,8 +29,8 @@ app.add_middleware(
 
 )
 
-# API token validation for write operations
-API_TOKEN=os.environ.get('API_TOKEN', '')
+# API token validation — disabled. Authelia (Caddy forward_auth) handles auth upstream.
+API_TOKEN=""
 
 async def validate_api_token(request: Request, call_next):
     path = request.url.path