Restore FluxCD auto-deployment via GitOps

Replace direct kubectl deployment with GitOps pattern:
- Build and push to git.mcintire.me registry using built-in token
- Commit updated image tag in k8s/deployment.yaml after each build
- FluxCD picks up the manifest change and handles the k8s rollout
- Remove Tailscale, kubectl, and ghcr.io dependencies

.github/workflows/deploy.yml

@@ -10,8 +10,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  REGISTRY: ghcr.io
+  REGISTRY: git.mcintire.me
-  IMAGE_NAME: ${{ github.repository }}
+  IMAGE: git.mcintire.me/graham/aprs.me
 
 jobs:
   build-and-push:
@@ -19,6 +19,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+    outputs:
+      image_tag: ${{ steps.tag.outputs.image_tag }}
 
     steps:
       - name: Checkout repository
@@ -26,23 +28,20 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Log in to the Container registry
+      - name: Compute image tag
+        id: tag
+        run: |
+          TIMESTAMP=$(date +%s)
+          SHA=${GITHUB_SHA:0:7}
+          echo "image_tag=main-${TIMESTAMP}-${SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=sha,prefix={{branch}}-
-            type=raw,value=latest,enable={{is_default_branch}}
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -51,57 +50,35 @@ jobs:
         with:
           context: .
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          tags: |
-          labels: ${{ steps.meta.outputs.labels }}
+            ${{ env.IMAGE }}:${{ steps.tag.outputs.image_tag }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE }}:main
+          cache-from: type=registry,ref=${{ env.IMAGE }}:main
           cache-to: type=inline
 
   deploy:
     needs: build-and-push
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
     steps:
-      - name: Setup Tailscale
+      - name: Checkout repository
-        uses: tailscale/github-action@v2
+        uses: actions/checkout@v4
         with:
-          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          token: ${{ secrets.GITHUB_TOKEN }}
-          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
-          tags: tag:ci
 
-      - name: Set kubeconfig
+      - name: Update image in deployment manifest
         run: |
-          mkdir -p ~/.kube
+          NEW_IMAGE="${{ env.IMAGE }}:${{ needs.build-and-push.outputs.image_tag }}"
-          echo "${{ secrets.TAILSCALE_KUBECONFIG }}" | base64 -d > ~/.kube/config
+          sed -i "s|image: git.mcintire.me/graham/aprs.me:.*|image: ${NEW_IMAGE}|g" k8s/deployment.yaml
-          # Skip TLS verification for Tailscale IP connection
-          kubectl config set-cluster default --insecure-skip-tls-verify=true
 
-      - name: Deploy to K3s
+      - name: Commit and push updated manifest
         run: |
-          # Get current timestamp in ISO8601 format
+          NEW_IMAGE="${{ env.IMAGE }}:${{ needs.build-and-push.outputs.image_tag }}"
-          DEPLOYED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+          git config user.name "github-actions"
-          
+          git config user.email "github-actions@github.com"
-          # Create a temporary patch file with the deployment timestamp
+          git add k8s/deployment.yaml
-          cat > /tmp/deployed-at-patch.yaml <<EOF
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
-          apiVersion: apps/v1
+          git commit -m "chore: update aprs.me image to ${NEW_IMAGE} [skip ci]"
-          kind: StatefulSet
+          git push
-          metadata:
-            name: aprs
-            namespace: aprs
-          spec:
-            template:
-              spec:
-                containers:
-                - name: aprs
-                  env:
-                  - name: DEPLOYED_AT
-                    value: "$DEPLOYED_AT"
-          EOF
-          
-          # Apply the patch to set the deployment timestamp
-          kubectl patch statefulset aprs -n aprs --patch-file=/tmp/deployed-at-patch.yaml
-          
-          # Update the image
-          kubectl set image statefulset/aprs aprs=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest -n aprs
-          
-          # Force a rollout to ensure latest image is pulled
-          kubectl rollout restart statefulset/aprs -n aprs
-          echo "Deployment initiated with timestamp $DEPLOYED_AT - not waiting for rollout to complete"