.github/workflows/disabled/

.forgejo/workflows/test-autoscaling.yml

@@ -5,8 +5,7 @@ on:
 
 jobs:
   load-test:
-    runs-on: mealcraft-runners
+    runs-on: self-hosted
-    # container: ubuntu:22.04
 
     strategy:
       matrix:
@@ -37,4 +36,4 @@ jobs:
         run: echo "Running job ${{ matrix.job_id }}"
 
       - name: Simulate workload
-        run: sleep 60
+        run: sleep 60

.github/workflows/basic-system-information.yml

@@ -1,40 +0,0 @@
-name: Basic System Information
-on:
-  workflow_dispatch:
-
-jobs:
-  Basic-system-information:
-    runs-on: mealcraft-runners
-    container: ubuntu:22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: hi
-        run: echo "hi"
-      - name: user
-        run: echo $USER
-      - name: home
-        run: echo $HOME
-      - name: pwd
-        run: pwd
-      - name: ls -la
-        run: ls -la
-      - name: Install kubectl
-        run: |
-          apt-get update
-          apt-get install -y ca-certificates curl
-          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          install -m 0755 kubectl /usr/local/bin/kubectl
-      - name: Configure kubeconfig from runner SA
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster k8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials sa --token="$SA_TOKEN"
-          kubectl config set-context sa-context --cluster=k8s --user=sa --namespace="$NAMESPACE"
-          kubectl config use-context sa-context
-
-      - name: kubectl test
-        run: kubectl get pods -A

.github/workflows/ha.yml

@@ -1,46 +0,0 @@
-name: Deploy Home Assistant
-
-on:
-  push:
-    branches:
-      - main
-
-env:
-  MANIFEST_PATH: "homeassistant/homeassistant.yml"
-
-jobs:
-  deploy:
-    runs-on: mealcraft-runners
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Install envsubst
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      - name: Configure kubeconfig
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
-          kubectl config use-context runner-context
-
-      - name: Deploy Home Assistant
-        run: |
-          echo "Deploying Home Assistant from $MANIFEST_PATH"
-          kubectl apply -f $MANIFEST_PATH

.github/workflows/juntekim.yml

@@ -1,97 +0,0 @@
-name: Build juntekim.com
-
-on:
-  push:
-    tags:
-      - "*"
-    branches:
-      - "**"
-
-jobs:
-  Push-to-juntekim-to-docker-hub:
-    runs-on: ubuntu-22.04
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Inject slug/short variables
-        uses: rlespinasse/github-slug-action@v4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: Build Docker Image
-        run: |
-          docker build \
-            -f juntekim_frontend/deployment/Dockerfile \
-            -t docker.io/kimjunte/portfolio_page:$GITHUB_REF_SLUG \
-            juntekim_frontend
-
-      - name: Push to Docker Hub
-        run: |
-          docker push docker.io/kimjunte/portfolio_page:$GITHUB_REF_SLUG
-
-
-  run-on-k8s:
-    runs-on: mealcraft-runners      # <-- your ARC scale set label
-    needs: Push-to-juntekim-to-docker-hub
-    steps:
-      - uses: actions/checkout@v4
-
-      # Install kubectl inside containerMode's default Ubuntu
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Install envsubst
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext       # <---- envsubst lives here
-
-      # Configure kubeconfig from ARC's service account
-      - name: Configure kubeconfig
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
-          kubectl config use-context runner-context
-
-      - name: Inject slug variables
-        uses: rlespinasse/github-slug-action@v4
-
-      - name: Set namespace
-        id: ns
-        run: |
-          if [[ $GITHUB_REF == refs/tags/* ]]; then
-            echo "NAMESPACE=default" >> $GITHUB_ENV
-          else
-            echo "NAMESPACE=staging" >> $GITHUB_ENV
-          fi
-
-      - name: Set hostname
-        run: |
-          if [ "$NAMESPACE" = "staging" ]; then
-            echo "HOSTNAME=staging.juntekim.com" >> $GITHUB_ENV
-          else
-            echo "HOSTNAME=juntekim.com" >> $GITHUB_ENV
-          fi
-
-      - name: Deploy to Kubernetes
-        run: |
-          export IMAGE="docker.io/kimjunte/portfolio_page:$GITHUB_REF_SLUG"
-          export NAMESPACE HOSTNAME
-
-          envsubst < juntekim_frontend/deployment/deployment.yml | kubectl apply -f -
-          envsubst < juntekim_frontend/deployment/service.yml    | kubectl apply -f -
-          envsubst < juntekim_frontend/deployment/ingressroute.yml | kubectl apply -f -

.github/workflows/k8s_traefik_init_setup.yml

@@ -1,131 +0,0 @@
-name: K8s Bootstrap Setup
-
-on:
-  workflow_dispatch:
-
-jobs:
-
-  # -----------------------------------------------------
-  # Job 1: Build and push image using GitHub-hosted runner
-  # -----------------------------------------------------
-  build-image:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # Docker login on GitHub-hosted runner (has Docker)
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      # Build and push using real Docker daemon
-      - name: Build & Push Traefik Image
-        uses: docker/build-push-action@v5
-        with:
-          context: ./traefik
-          file: ./traefik/Dockerfile
-          push: true
-          tags: |
-            docker.io/kimjunte/edge_router:${{ github.sha }}
-            docker.io/kimjunte/edge_router:latest
-
-  # -----------------------------------------------------
-  # Job 2: Deploy to MicroK8s using ARC self-hosted runner
-  # -----------------------------------------------------
-  deploy:
-    runs-on: mealcraft-runners
-    needs: build-image
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # Install kubectl inside containerMode's default Ubuntu
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      # Configure kubeconfig from ARC's service account
-      - name: Configure kubeconfig
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
-          kubectl config use-context runner-context
-        
-      # -----------------------------------------------------
-      # ⭐ Inject AWS secrets needed for Traefik Route53 DNS
-      # -----------------------------------------------------
-      - name: Apply AWS Secrets
-        run: |
-          kubectl create secret generic aws-secrets \
-            --namespace=default \
-            --from-literal=AWS_ACCESS_KEY_ID='${{ secrets.AWS_ACCESS_KEY_ID }}' \
-            --from-literal=AWS_SECRET_ACCESS_KEY='${{ secrets.AWS_SECRET_ACCESS_KEY }}' \
-            --from-literal=AWS_REGION='${{ secrets.AWS_REGION }}' \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-      - name: Apply AWS Secrets
-        run: |
-          kubectl create namespace arc-systems \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-          kubectl create secret generic aws-secrets \
-            --namespace=arc-systems \
-            --from-literal=AWS_ACCESS_KEY_ID='${{ secrets.AWS_ACCESS_KEY_ID }}' \
-            --from-literal=AWS_SECRET_ACCESS_KEY='${{ secrets.AWS_SECRET_ACCESS_KEY }}' \
-            --from-literal=AWS_REGION='${{ secrets.AWS_REGION }}' \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-      # Apply storage classes + PVs
-      - name: Apply StorageClass + PV
-        run: |
-          kubectl apply -f traefik/storageclass/storageclass.yaml
-          kubectl apply -f traefik/storageclass/certs-pv.yaml
-
-      # # Install Traefik CRDs (idempotent)
-      # - name: Install Traefik CRDs
-      #   run: |
-      #     kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
-      #     kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
-
-      # Deploy Traefik
-      - name: Deploy Traefik
-        run: |
-          kubectl apply -f traefik/edge-router/pvc.yaml
-          kubectl apply -f traefik/edge-router/traefik-deployment.yml
-          kubectl apply -f traefik/edge-router/traefik-services.yml
-          kubectl apply -f traefik/edge-router/middleware.yaml
-          kubectl apply -f traefik/edge-router/secret-dashboard.yml
-          kubectl apply -f traefik/edge-router/traefik-ingressroute.yml
-
-      # Deploy whoami test app
-      - name: Deploy whoami
-        run: |
-          kubectl apply -f traefik/who-am-i/whoami-deployment.yml
-          kubectl apply -f traefik/who-am-i/whoami-service.yml
-          kubectl apply -f traefik/who-am-i/whoami-ingressroute.yml
-
-      # Registry secret
-      - name: Create registry secret (default)
-        run: kubectl apply -f traefik/docker-registry-credentials/docker-credentials.yml
-
-      # Staging namespace
-      - name: Create staging namespace
-        run: kubectl get ns staging >/dev/null 2>&1 || kubectl create namespace staging
-
-      - name: Registry secret to staging
-        run: |
-          sed 's/namespace: default/namespace: staging/' \
-            traefik/docker-registry-credentials/docker-credentials.yml \
-            | kubectl apply -f -

.github/workflows/n8n.yml

@@ -1,53 +0,0 @@
-name: Deploy n8n
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "*"
-
-env:
-  IMAGE: "docker.io/n8nio/n8n:latest"
-  MANIFEST_PATH: "n8n/n8n.yml"
-
-jobs:
-  deploy:
-    runs-on: mealcraft-runners
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      # Install kubectl
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      # Install envsubst
-      - name: Install envsubst
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      # Configure kubeconfig from ARC pod service account
-      - name: Configure kubeconfig
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
-          kubectl config use-context runner-context
-
-      - name: Deploy n8n to Kubernetes
-        run: |
-          echo "Deploying n8n with IMAGE=$IMAGE"
-          export IMAGE
-          envsubst < $MANIFEST_PATH | kubectl apply -f -

.github/workflows/pihole.yml

@@ -1,47 +0,0 @@
-name: Deploy pihole
-
-on:
-  workflow_dispatch:
-
-env:
-  MANIFEST_PATH: "pihole/pihole.yml"
-
-jobs:
-  deploy:
-    runs-on: mealcraft-runners
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      # Install kubectl
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      # Install envsubst
-      - name: Install envsubst
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      # Configure kubeconfig (ARC service account)
-      - name: Configure kubeconfig
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
-          kubectl config use-context runner-context
-
-      - name: Deploy Pi-hole to Kubernetes
-        run: |
-          echo "Deploying Pi-hole"
-          envsubst < $MANIFEST_PATH | kubectl apply -f -

.github/workflows/ses-juntekim.yml

@@ -1,71 +0,0 @@
-name: SES - juntekim.com [Simple Email Service]
-
-on:
-  pull_request:
-    paths:
-      - "aws_environment/ses-juntekim/**"
-
-env:
-  TF_VERSION: "1.6.6"
-  WORKING_DIR: "aws_environment/ses-juntekim"
-
-jobs:
-  terraform-plan:
-    name: Terraform Plan - SES
-    runs-on: mealcraft-runners
-
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: ${{ env.TF_VERSION }}
-
-      - name: Install AWS CLI v2
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y unzip curl
-
-          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-          unzip awscliv2.zip
-          sudo ./aws/install
-
-          aws --version
-
-      - name: Verify AWS identity
-        run: aws sts get-caller-identity
-
-      - name: Terraform Init
-        working-directory: ${{ env.WORKING_DIR }}
-        run: terraform init
-
-      - name: Terraform Validate
-        working-directory: ${{ env.WORKING_DIR }}
-        run: terraform validate
-
-      - name: Terraform Plan
-        id: plan
-        working-directory: ${{ env.WORKING_DIR }}
-        run: terraform plan -input=false -out=tfplan
-
-      - name: Comment Plan on PR
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const fs = require('fs');
-            const planOutput = `${{ steps.plan.outputs.stdout }}`;
-
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: `## Terraform Plan - SES\n\n\`\`\`\n${planOutput}\n\`\`\``
-            });
-        continue-on-error: true

.github/workflows/stripe-to-invoice.yml

@@ -1,347 +0,0 @@
-name: Build & Deploy stripe-to-invoice (with DB secrets + migrations)
-
-on:
-  push:
-    branches:
-      - "**"
-    tags:
-      - "*"
-  workflow_dispatch:
-
-jobs:
-  # --------------------------------------------------
-  # BUILD IMAGE
-  # --------------------------------------------------
-  build:
-    runs-on: ubuntu-22.04
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Inject slug variables
-        uses: rlespinasse/github-slug-action@v4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build & push image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: stripe_to_invoice/deployment/Dockerfile
-          push: true
-          tags: docker.io/kimjunte/stripe_to_invoice:${{ env.GITHUB_REF_SLUG }}
-
-  # --------------------------------------------------
-  # DEPLOY POSTGRES (DEV / PROD)
-  # --------------------------------------------------
-  deploy-db:
-    name: Deploy Postgres (PV + PVC + Deployment)
-    runs-on: mealcraft-runners
-    needs: build
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates gettext
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Configure kubeconfig (in-cluster)
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner
-          kubectl config use-context runner-context
-
-      - name: Decide environment
-        run: |
-          if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
-            echo "ENV=prod" >> $GITHUB_ENV
-            echo "NAMESPACE=default" >> $GITHUB_ENV
-            echo "PG_VOLUME=stripe_invoice_prod" >> $GITHUB_ENV
-          else
-            echo "ENV=dev" >> $GITHUB_ENV
-            echo "NAMESPACE=dev" >> $GITHUB_ENV
-            echo "PG_VOLUME=stripe_invoice_dev" >> $GITHUB_ENV
-          fi
-
-      - name: Apply Postgres manifests
-        run: |
-          export ENV NAMESPACE PG_VOLUME
-          envsubst < db/k8s/postgres/stripe-to-invoice-db.yaml | kubectl apply -f -
-
-  # --------------------------------------------------
-  # APPLY DB + APP SECRETS
-  # --------------------------------------------------
-  secrets:
-    name: Apply runtime secrets
-    runs-on: mealcraft-runners
-    needs: deploy-db
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # 🔧 MINIMAL FIX (ENV bootstrap)
-      - name: Decide environment (from ref)
-        run: |
-          if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
-            echo "ENV=prod" >> $GITHUB_ENV
-          else
-            echo "ENV=dev" >> $GITHUB_ENV
-          fi
-
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates gettext
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Configure kubeconfig (in-cluster)
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner
-          kubectl config use-context runner-context
-
-      - name: Decide environment
-        run: |
-          if [[ "$ENV" == "prod" ]]; then
-            echo "POSTGRES_HOST=postgres-prod.default.svc.cluster.local" >> $GITHUB_ENV
-            echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
-            echo "RUNTIME_SECRET=postgres-prod" >> $GITHUB_ENV
-            echo "NAMESPACE=default" >> $GITHUB_ENV
-          else
-            echo "POSTGRES_HOST=postgres-dev.dev.svc.cluster.local" >> $GITHUB_ENV
-            echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
-            echo "RUNTIME_SECRET=postgres-dev" >> $GITHUB_ENV
-            echo "NAMESPACE=dev" >> $GITHUB_ENV
-          fi
-
-      - name: Apply DB secret
-        run: |
-          set -a
-          source db/.env
-          set +a
-
-          if [[ "$ENV" == "prod" ]]; then
-            USER="$PROD_POSTGRES_USER"
-            PASS="$PROD_POSTGRES_PASSWORD"
-          else
-            USER="$DEV_POSTGRES_USER"
-            PASS="$DEV_POSTGRES_PASSWORD"
-          fi
-
-          DATABASE_URL="postgres://${USER}:${PASS}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?sslmode=disable"
-
-          kubectl create secret generic "$RUNTIME_SECRET" \
-            --namespace "$NAMESPACE" \
-            --from-literal=POSTGRES_USER="$USER" \
-            --from-literal=POSTGRES_PASSWORD="$PASS" \
-            --from-literal=POSTGRES_DB="$POSTGRES_DB" \
-            --from-literal=DATABASE_URL="$DATABASE_URL" \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-      - name: Apply app secrets
-        run: |
-          set -e
-          set -a
-          source stripe_to_invoice/deployment/secrets/.env
-          set +a
-
-          if [[ "$ENV" == "prod" ]]; then
-            STRIPE_SECRET_KEY="$PROD_STRIPE_SECRET_KEY"
-            STRIPE_CLIENT_ID="$PROD_STRIPE_CLIENT_ID"
-            STRIPE_REDIRECT_URI="$PROD_STRIPE_REDIRECT_URI"
-            APP_URL="$PROD_APP_URL"
-            XERO_CLIENT_ID="$PROD_XERO_CLIENT_ID"
-            XERO_CLIENT_SECRET="$PROD_XERO_SECRET_KEY"
-            XERO_REDIRECT_URI="$PROD_XERO_REDIRECT_URI"
-            AWS_REGION="$PROD_AWS_REGION"
-            AWS_ACCESS_KEY_ID="$PROD_AWS_ACCESS_KEY_ID"
-            AWS_SECRET_ACCESS_KEY="$PROD_AWS_SECRET_ACCESS_KEY"
-            STRIPE_WEBHOOK_SECRET="$PROD_STRIPE_WEBHOOK_SECRET"
-            SES_FROM_EMAIL="$PROD_SES_FROM_EMAIL"
-            STRIPE_BILLING_SECRET_KEY="$PROD_STRIPE_BILLING_SECRET_KEY"
-            STRIPE_BILLING_WEBHOOK_SECRET="$PROD_STRIPE_BILLING_WEBHOOK_SECRET"
-            STRIPE_SUBSCRIPTION_PRICE_ID="$PROD_STRIPE_SUBSCRIPTION_PRICE_ID"
-          else
-            STRIPE_SECRET_KEY="$DEV_STRIPE_SECRET_KEY"
-            STRIPE_CLIENT_ID="$DEV_STRIPE_CLIENT_ID"
-            STRIPE_REDIRECT_URI="$DEV_STRIPE_REDIRECT_URI"
-            APP_URL="$DEV_APP_URL"
-            XERO_CLIENT_ID="$DEV_XERO_CLIENT_ID"
-            XERO_CLIENT_SECRET="$DEV_XERO_SECRET_KEY"
-            XERO_REDIRECT_URI="$DEV_XERO_REDIRECT_URI"
-            AWS_REGION="$DEV_AWS_REGION"
-            AWS_ACCESS_KEY_ID="$DEV_AWS_ACCESS_KEY_ID"
-            AWS_SECRET_ACCESS_KEY="$DEV_AWS_SECRET_ACCESS_KEY"
-            STRIPE_WEBHOOK_SECRET="$DEV_STRIPE_WEBHOOK_SECRET"
-            SES_FROM_EMAIL="$DEV_SES_FROM_EMAIL"
-            STRIPE_BILLING_SECRET_KEY="$DEV_STRIPE_BILLING_SECRET_KEY"
-            STRIPE_BILLING_WEBHOOK_SECRET="$DEV_STRIPE_BILLING_WEBHOOK_SECRET"
-            STRIPE_SUBSCRIPTION_PRICE_ID="$DEV_STRIPE_SUBSCRIPTION_PRICE_ID"
-          fi
-
-          export \
-            STRIPE_SECRET_KEY \
-            STRIPE_CLIENT_ID \
-            STRIPE_REDIRECT_URI \
-            APP_URL \
-            XERO_CLIENT_ID \
-            XERO_CLIENT_SECRET \
-            XERO_REDIRECT_URI \
-            AWS_REGION \
-            AWS_ACCESS_KEY_ID \
-            AWS_SECRET_ACCESS_KEY \
-            STRIPE_WEBHOOK_SECRET \
-            SES_FROM_EMAIL \
-            STRIPE_BILLING_SECRET_KEY \
-            STRIPE_BILLING_WEBHOOK_SECRET \
-            STRIPE_SUBSCRIPTION_PRICE_ID \
-            NAMESPACE
-
-          envsubst < stripe_to_invoice/deployment/secrets/stripe-secrets.yaml | kubectl apply -f -
-
-  # --------------------------------------------------
-  # RUN ATLAS MIGRATIONS
-  # --------------------------------------------------
-  migrate:
-    name: Run DB migrations (Atlas)
-    runs-on: mealcraft-runners
-    needs: secrets
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # 🔧 MINIMAL FIX (ENV bootstrap)
-      - name: Decide environment (from ref)
-        run: |
-          if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
-            echo "ENV=prod" >> $GITHUB_ENV
-          else
-            echo "ENV=dev" >> $GITHUB_ENV
-          fi
-
-      - name: Install Atlas
-        uses: ariga/setup-atlas@v0
-
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates gettext
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Configure kubeconfig (in-cluster)
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner
-          kubectl config use-context runner-context
-
-      - name: Decide environment
-        run: |
-          if [[ "$ENV" == "prod" ]]; then
-            echo "SECRET=postgres-prod" >> $GITHUB_ENV
-            echo "NAMESPACE=default" >> $GITHUB_ENV
-          else
-            echo "SECRET=postgres-dev" >> $GITHUB_ENV
-            echo "NAMESPACE=dev" >> $GITHUB_ENV
-          fi
-
-      - name: Run migrations (DEBUG – FULL DATABASE_URL)
-        run: |
-          DATABASE_URL=$(kubectl get secret "$SECRET" \
-            -n "$NAMESPACE" \
-            -o jsonpath='{.data.DATABASE_URL}' | base64 -d)
-
-          echo "DATABASE_URL (FULL DEBUG — REMOVE AFTER):"
-          echo "$DATABASE_URL"
-
-          atlas migrate apply \
-            --dir file://db/atlas/stripe_invoice/migrations \
-            --url "$DATABASE_URL"
-
-  # --------------------------------------------------
-  # DEPLOY APPLICATION
-  # --------------------------------------------------
-  deploy:
-    runs-on: mealcraft-runners
-    needs:
-      - build
-      - secrets
-      - migrate
-
-    steps:
-      - uses: actions/checkout@v4
-
-      # 🔧 MINIMAL FIX (ENV bootstrap)
-      - name: Decide environment (from ref)
-        run: |
-          if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
-            echo "ENV=prod" >> $GITHUB_ENV
-          else
-            echo "ENV=dev" >> $GITHUB_ENV
-          fi
-
-      - name: Install kubectl
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl ca-certificates gettext
-          curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          sudo install -m 0755 kubectl /usr/local/bin/kubectl
-
-      - name: Configure kubeconfig (in-cluster)
-        run: |
-          KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
-          SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-          CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-
-          kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
-          kubectl config set-credentials runner --token="$SA_TOKEN"
-          kubectl config set-context runner-context --cluster=microk8s --user=runner
-          kubectl config use-context runner-context
-
-      - name: Inject slug variables
-        uses: rlespinasse/github-slug-action@v4
-
-      - name: Decide environment
-        run: |
-          if [[ "$ENV" == "prod" ]]; then
-            echo "NAMESPACE=default" >> $GITHUB_ENV
-            echo "DB_ENV=prod" >> $GITHUB_ENV
-            echo "HOSTNAME=stripetoinvoice.com" >> $GITHUB_ENV
-          else
-            echo "NAMESPACE=dev" >> $GITHUB_ENV
-            echo "DB_ENV=dev" >> $GITHUB_ENV
-            echo "HOSTNAME=stripe-to-invoice.dev.juntekim.com" >> $GITHUB_ENV
-          fi
-
-      - name: Deploy application
-        run: |
-          export IMAGE="docker.io/kimjunte/stripe_to_invoice:$GITHUB_REF_SLUG"
-          export NAMESPACE DB_ENV HOSTNAME
-          envsubst < stripe_to_invoice/deployment/deployment.yaml | kubectl apply -f -

.github/workflows/terraform-apply.yml

@@ -1,128 +0,0 @@
-name: "Terraform Apply"
-
-on:
-  push:
-    branches:
-      - main
-
-env:
-  TF_CLOUD_ORGANIZATION: "MealCraft"
-  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
-  TF_WORKSPACE: "production"
-  CONFIG_DIRECTORY: aws_environment
-  TF_VAR_public_ip: "${{ secrets.PUBLIC_IP }}"
-
-jobs:
-  terraform:
-    if: github.repository != 'hashicorp-education/learn-terraform-github-actions'
-    name: "Terraform Apply"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Debug Paths
-        run: |
-          echo "Workspace: $GITHUB_WORKSPACE"
-          ls -R .
-          echo "CONFIG_DIRECTORY: $CONFIG_DIRECTORY"
-          ls -R "$CONFIG_DIRECTORY"
-
-      - name: Upload Configuration
-        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
-        id: apply-upload
-        with:
-          workspace: ${{ env.TF_WORKSPACE }}
-          directory: ${{ env.CONFIG_DIRECTORY }}
-
-      - name: Create Apply Run
-        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
-        id: apply-run
-        with:
-          workspace: ${{ env.TF_WORKSPACE }}
-          configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
-
-      # Terraform marks the run as "confirmable" using lowercase attribute
-      - name: Apply
-        if: fromJSON(steps.apply-run.outputs.payload).data.attributes.actions.is_confirmable
-        uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
-        id: apply
-        with:
-          comment: "Apply from GitHub Actions CI ${{ github.sha }}"
-          run: ${{ steps.apply-run.outputs.run_id }}
-
-      - name: Print TF_VAR_public_ip
-        run: 'echo "📡 Public IP used by Terraform: $TF_VAR_public_ip"'
-
-  terraform-ses:
-    if: github.repository != 'hashicorp-education/learn-terraform-github-actions'
-    name: "Terraform Apply - SES"
-    runs-on: mealcraft-runners
-    needs: terraform
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      # - name: Install modern Node.js
-      #   run: |
-      #     curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
-      #     sudo apt-get install -y nodejs
-      #     node --version
-
-      # - name: Setup Terraform
-      #   uses: hashicorp/setup-terraform@v3
-      #   with:
-      #     terraform_version: "1.6.6"
-
-      # - name: Install AWS CLI v2
-      #   run: |
-      #     sudo apt-get update
-      #     sudo apt-get install -y unzip curl
-
-      #     curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-      #     unzip awscliv2.zip
-      #     sudo ./aws/install
-
-      #     aws --version
-
-      # - name: Verify AWS identity
-      #   run: aws sts get-caller-identity
-
-      # - name: Terraform Init
-      #   working-directory: aws_environment/ses-juntekim
-      #   run: terraform init
-
-      # - name: Terraform Validate
-      #   working-directory: aws_environment/ses-juntekim
-      #   run: terraform validate
-
-      # - name: Terraform Plan
-      #   id: plan
-      #   working-directory: aws_environment/ses-juntekim
-      #   run: terraform plan -input=false
-
-      # - name: Terraform Apply
-      #   working-directory: aws_environment/ses-juntekim
-      #   run: terraform apply -auto-approve -input=false
-
-      - name: Future Improvement Reminder
-        run: |
-          echo ""
-          echo "⚠️  REMINDER: Future maintenance required for SES Terraform"
-          echo ""
-          echo "This SES configuration currently uses a separate S3 backend for state management."
-          echo "Plan to consolidate and migrate away from Hashicorp Terraform Cloud:"
-          echo ""
-          echo "TODO:"
-          echo "  - [ ] Consolidate SES terraform into main Terraform Cloud workspace"
-          echo "  - [ ] Move away from Hashicorp Terraform Cloud entirely"
-          echo "  - [ ] Use alternative state management solution for all infrastructure"
-          echo ""
-          echo "See: aws_environment/ses-juntekim/README.md for details"
-          echo ""

.github/workflows/terraform-plan.yml

@@ -1,89 +0,0 @@
-name: "Terraform Plan"
-
-on:
-  pull_request:
-
-env:
-  TF_CLOUD_ORGANIZATION: "MealCraft"
-  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
-  TF_WORKSPACE: "production"
-  CONFIG_DIRECTORY: aws_environment
-  TF_VAR_public_ip: "${{ secrets.PUBLIC_IP }}"
-
-jobs:
-  terraform:
-    if: github.repository != 'hashicorp-education/learn-terraform-github-actions'
-    name: "Terraform Plan"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Debug Paths
-        run: |
-          echo "Workspace: $GITHUB_WORKSPACE"
-          ls -R .
-          echo "CONFIG_DIRECTORY: $CONFIG_DIRECTORY"
-          ls -R "$CONFIG_DIRECTORY"
-      - name: Upload Configuration
-        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
-        id: plan-upload
-        with:
-          workspace: ${{ env.TF_WORKSPACE }}
-          directory: ${{ env.CONFIG_DIRECTORY }}
-          speculative: true
-
-      - name: Create Plan Run
-        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
-        id: plan-run
-        with:
-          workspace: ${{ env.TF_WORKSPACE }}
-          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
-          plan_only: true
-
-      - name: Get Plan Output
-        uses: hashicorp/tfc-workflows-github/actions/plan-output@v1.0.0
-        id: plan-output
-        with:
-          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}
-
-      - name: Update PR
-        uses: actions/github-script@v6
-        id: plan-comment
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            // 1. Retrieve existing bot comments for the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const botComment = comments.find(comment => {
-              return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
-            });
-            const output = `#### Terraform Cloud Plan Output
-               \`\`\`
-               Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
-               \`\`\`
-               [Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
-               `;
-            if (botComment) {
-              github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: botComment.id,
-              });
-            }
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: output
-            })
-
-      - name: Print TF_VAR_public_ip
-        run: 'echo "📡 Public IP used by Terraform: $TF_VAR_public_ip"'
-