From 8673c0f05c3995c1ee876605db58ca7f90ea679b Mon Sep 17 00:00:00 2001
From: AIIrondev <iron.ai.dev@gmail.com>
Date: Wed, 16 Sep 2026 15:02:00 +0200
Subject: [PATCH] secrets processibg chanbged

---
 .github/workflows/release-docker.yml | 192 ++++++++++++++-------------
 1 file changed, 100 insertions(+), 92 deletions(-)

diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index 9ec278c..d32ba20 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -230,98 +230,106 @@ jobs:
           tags: |
             ${{ steps.meta.outputs.image }}
 
-      - name: Create release-only docker bundle
-        run: |
-            mkdir -p release-bundle
-            cat > release-bundle/docker-compose.yml <<EOF
-            services:
-              app:
-                image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
-                container_name: inventarsystem-app
-                restart: unless-stopped
-                ports:
-                  - "\${INVENTAR_HTTP_PORT:-10000}:8000"
-                depends_on:
-                  - mongodb
-                  - redis
-                environment:
-                  INVENTAR_MONGODB_HOST: mongodb
-                  INVENTAR_MONGODB_PORT: "27017"
-                  INVENTAR_MONGODB_DB: Inventarsystem
-                  INVENTAR_BACKUP_FOLDER: /data/backups
-                  INVENTAR_LOGS_FOLDER: /data/logs
-                  INVENTAR_SECRET_KEY: ${{ secrets.INVENTAR_SECRET_KEY }}
-                  INVENTAR_DATA_ENCRYPTION_KEY: ${{ secrets.INVENTAR_DATA_ENCRYPTION_KEY }}
-                  INVENTAR_MONGODB_PASSWORD: ${{ secrets.INVENTAR_MONGODB_PASSWORD }}
-                  EMAIL_ENABLED: ${{ secrets.EMAIL_ENABLED }}
-                  EMAIL_SMTP_HOST: mai.invario-software.de
-                  EMAIL_SMTP_PORT: 587
-                  EMAIL_USERNAME: no-reply@invario-software.de
-                  EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}
-                  EMAIL_FROM_ADDRESS: ${{ secrets.EMAIL_FROM_ADDRESS }}
-                expose:
-                  - "8000"
-                volumes:
-                  - ./config.json:/app/config.json:ro
-                  - app_uploads:/app/Web/uploads
-                  - app_thumbnails:/app/Web/thumbnails
-                  - app_previews:/app/Web/previews
-                  - app_qrcodes:/app/Web/QRCodes
-                  - app_backups:/data/backups
-                  - app_logs:/data/logs
-            
-              mongodb:
-                image: mongo:7.0
-                container_name: inventarsystem-mongodb
-                restart: unless-stopped
-                volumes:
-                  - mongodb_data:/data/db
-                healthcheck:
-                  test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-                  interval: 10s
-                  timeout: 5s
-                  retries: 10
-            
-              redis:
-                image: redis:7-alpine
-                container_name: inventarsystem-redis
-                restart: unless-stopped
-                command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
-                ports:
-                  - "6379:6379"
-                volumes:
-                  - redis_data:/data
-                healthcheck:
-                  test: ["CMD", "redis-cli", "ping"]
-                  interval: 10s
-                  timeout: 5s
-                  retries: 5
-            
-            volumes:
-              mongodb_data:
-              app_uploads:
-              app_thumbnails:
-              app_previews:
-              app_qrcodes:
-              app_backups:
-              app_logs:
-              redis_data:
-            EOF
-            
-            for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do
-              if [ -f "$f" ]; then
-                cp "$f" "release-bundle/$(basename "$f")"
-              fi
-            done
-            
-            for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do
-              if [ -f "$f" ]; then
-                cp "$f" "release-bundle/$(basename "$f")"
-              fi
-            done
-            
-            find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
-            tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
+      - name: Create release-only docker bundle 
+        run: | 
+             mkdir -p release-bundle 
+
+             # 1. .env Datei aus Gitea Secrets erzeugen
+             cat > release-bundle/.env <<EOF
+             INVENTAR_SECRET_KEY=${{ secrets.INVENTAR_SECRET_KEY }}
+             INVENTAR_DATA_ENCRYPTION_KEY=${{ secrets.INVENTAR_DATA_ENCRYPTION_KEY }}
+             INVENTAR_MONGODB_PASSWORD=${{ secrets.INVENTAR_MONGODB_PASSWORD }}
+             EMAIL_ENABLED=${{ secrets.EMAIL_ENABLED }}
+             EMAIL_SMTP_HOST=${{ secrets.EMAIL_SMTP_HOST }}
+             EMAIL_SMTP_PORT=${{ secrets.EMAIL_SMTP_PORT }}
+             EMAIL_USERNAME=${{ secrets.EMAIL_USERNAME }}
+             EMAIL_PASSWORD=${{ secrets.EMAIL_PASSWORD }}
+             EMAIL_FROM_ADDRESS=${{ secrets.EMAIL_FROM_ADDRESS }}
+             EOF
+
+             # 2. docker-compose.yml nutzt env_file
+             cat > release-bundle/docker-compose.yml <<EOF 
+             services: 
+               app: 
+                 image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}} 
+                 container_name: inventarsystem-app 
+                 restart: unless-stopped 
+                 env_file:
+                   - .env
+                 ports: 
+                   - "\${INVENTAR_HTTP_PORT:-10000}:8000" 
+                 depends_on: 
+                   - mongodb 
+                   - redis 
+                 environment: 
+                   INVENTAR_MONGODB_HOST: mongodb 
+                   INVENTAR_MONGODB_PORT: "27017" 
+                   INVENTAR_MONGODB_DB: Inventarsystem 
+                   INVENTAR_BACKUP_FOLDER: /data/backups 
+                   INVENTAR_LOGS_FOLDER: /data/logs 
+                 expose: 
+                   - "8000" 
+                 volumes: 
+                   - ./config.json:/app/config.json:ro 
+                   - app_uploads:/app/Web/uploads 
+                   - app_thumbnails:/app/Web/thumbnails 
+                   - app_previews:/app/Web/previews 
+                   - app_qrcodes:/app/Web/QRCodes 
+                   - app_backups:/data/backups 
+                   - app_logs:/data/logs 
+              
+               mongodb: 
+                 image: mongo:7.0 
+                 container_name: inventarsystem-mongodb 
+                 restart: unless-stopped 
+                 volumes: 
+                   - mongodb_data:/data/db 
+                 healthcheck: 
+                   test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"] 
+                   interval: 10s 
+                   timeout: 5s 
+                   retries: 10 
+              
+               redis: 
+                 image: redis:7-alpine 
+                 container_name: inventarsystem-redis 
+                 restart: unless-stopped 
+                 command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru 
+                 ports: 
+                   - "6379:6379" 
+                 volumes: 
+                   - redis_data:/data 
+                 healthcheck: 
+                   test: ["CMD", "redis-cli", "ping"] 
+                   interval: 10s 
+                   timeout: 5s 
+                   retries: 5 
+              
+             volumes: 
+               mongodb_data: 
+               app_uploads: 
+               app_thumbnails: 
+               app_previews: 
+               app_qrcodes: 
+               app_backups: 
+               app_logs: 
+               redis_data: 
+             EOF 
+              
+             for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do 
+               if [ -f "$f" ]; then 
+                 cp "$f" "release-bundle/$(basename "$f")" 
+               fi 
+             done 
+              
+             for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do 
+               if [ -f "$f" ]; then 
+                 cp "$f" "release-bundle/$(basename "$f")" 
+               fi 
+             done 
+              
+             find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true 
+             tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
 
       - name: Create or update Gitea Release
         uses: https://gitea.com/actions/gitea-release-action@v1