Use Docker image for CLI instead of Gitea DEB download

Run sfp CLI directly from inside the pulled server image via
docker run, removing the need for a separate GITEA_TOKEN and
CLI download step. Default TLS mode changed to letsencrypt.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/check-update.yml

@@ -1,4 +1,4 @@
-name: Check for Updates
+name: Check Deployed Version
 
 on:
   schedule:
@@ -7,38 +7,10 @@ on:
 
 jobs:
   check:
-    name: 'Check for new version'
+    name: 'Check deployed version'
     runs-on: ubuntu-latest
 
     steps:
-      - name: Check latest version on Gitea
-        id: check
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        run: |
-          echo "Checking for latest SFP Server release..."
-
-          RELEASE_INFO=$(curl -sf -H "Authorization: token $GITEA_TOKEN" \
-            "https://source.flxbl.io/api/v1/repos/flxbl/sfp-pro/releases?limit=10")
-
-          if [ $? -ne 0 ] || [ -z "$RELEASE_INFO" ]; then
-            echo "Failed to fetch releases from Gitea API"
-            exit 1
-          fi
-
-          # Get latest non-draft release
-          LATEST_TAG=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .tag_name // "unknown"')
-          LATEST_DATE=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .published_at // "unknown"')
-          LATEST_BODY=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .body // ""')
-
-          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
-          echo "latest_date=$LATEST_DATE" >> $GITHUB_OUTPUT
-
-          # Save release body for the issue
-          echo "$LATEST_BODY" > /tmp/release_notes.md
-
-          echo "Latest release: $LATEST_TAG (published: $LATEST_DATE)"
-
       - name: Check current deployed version
         id: current
         env:
@@ -50,7 +22,7 @@ jobs:
           BASE_DIR="${{ vars.BASE_DIR || './sfp-server' }}"
 
           if [ -z "$SSH_HOST" ] || [ -z "$SSH_PRIVATE_KEY" ]; then
-            echo "SSH not configured, skipping deployed version check"
+            echo "SSH not configured, cannot check deployed version"
             echo "current_tag=unknown" >> $GITHUB_OUTPUT
             exit 0
           fi
@@ -64,102 +36,35 @@ jobs:
             "grep '^IMAGE_TAG=' ${BASE_DIR}/tenants/${TENANT}/.env 2>/dev/null | cut -d= -f2" \
             2>/dev/null || echo "unknown")
 
+          CURRENT_FQDN=$(ssh -i ~/.ssh/deploy_key "$SSH_USER@$SSH_HOST" \
+            "grep '^IMAGE_FQDN=' ${BASE_DIR}/tenants/${TENANT}/.env 2>/dev/null | cut -d= -f2" \
+            2>/dev/null || echo "unknown")
+
           echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
-          echo "Currently deployed: $CURRENT_TAG"
+          echo "current_fqdn=$CURRENT_FQDN" >> $GITHUB_OUTPUT
+          echo "Currently deployed: $CURRENT_FQDN:$CURRENT_TAG"
 
       - name: Generate summary
         run: |
-          LATEST="${{ steps.check.outputs.latest_tag }}"
-          CURRENT="${{ steps.current.outputs.current_tag }}"
+          CURRENT_TAG="${{ steps.current.outputs.current_tag }}"
+          CURRENT_FQDN="${{ steps.current.outputs.current_fqdn }}"
+          CONFIGURED_TAG="${{ vars.IMAGE_TAG || 'latest' }}"
+          CONFIGURED_FQDN="${{ vars.IMAGE_FQDN }}"
 
-          echo "## SFP Server Version Check" >> $GITHUB_STEP_SUMMARY
+          echo "## SFP Server Version Status" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| | Version |" >> $GITHUB_STEP_SUMMARY
-          echo "|---|---------|" >> $GITHUB_STEP_SUMMARY
-          echo "| Latest Available | \`$LATEST\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| Currently Deployed | \`$CURRENT\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| | Image | Tag |" >> $GITHUB_STEP_SUMMARY
+          echo "|---|-------|-----|" >> $GITHUB_STEP_SUMMARY
+          echo "| **Deployed** | \`$CURRENT_FQDN\` | \`$CURRENT_TAG\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Configured** | \`$CONFIGURED_FQDN\` | \`$CONFIGURED_TAG\` |" >> $GITHUB_STEP_SUMMARY
 
-          if [ "$LATEST" != "$CURRENT" ] && [ "$CURRENT" != "unknown" ] && [ "$LATEST" != "unknown" ]; then
+          if [ "$CURRENT_TAG" != "$CONFIGURED_TAG" ] && [ "$CURRENT_TAG" != "unknown" ]; then
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "A newer version is available. Run the **Update SFP Server** workflow to update." >> $GITHUB_STEP_SUMMARY
-          elif [ "$CURRENT" = "unknown" ]; then
+            echo "Deployed version differs from configured version. Run the **Update SFP Server** workflow to update." >> $GITHUB_STEP_SUMMARY
+          elif [ "$CURRENT_TAG" = "unknown" ]; then
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "Could not determine currently deployed version." >> $GITHUB_STEP_SUMMARY
           else
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Server is up to date." >> $GITHUB_STEP_SUMMARY
+            echo "Server is running the configured version." >> $GITHUB_STEP_SUMMARY
           fi
-
-      - name: Create or update issue if update available
-        if: steps.check.outputs.latest_tag != steps.current.outputs.current_tag && steps.current.outputs.current_tag != 'unknown' && steps.check.outputs.latest_tag != 'unknown'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const title = 'New SFP Server Version Available';
-            const latest = '${{ steps.check.outputs.latest_tag }}';
-            const current = '${{ steps.current.outputs.current_tag }}';
-            const fs = require('fs');
-            const releaseNotes = fs.existsSync('/tmp/release_notes.md')
-              ? fs.readFileSync('/tmp/release_notes.md', 'utf8')
-              : '';
-
-            const body = [
-              `## New Version Available`,
-              ``,
-              `| | Version |`,
-              `|---|---------|`,
-              `| **Latest** | \`${latest}\` |`,
-              `| **Current** | \`${current}\` |`,
-              ``,
-              `### How to Update`,
-              `1. Go to **Actions** > **Update SFP Server**`,
-              `2. Click **Run workflow**`,
-              `3. Optionally specify the docker tag: \`${latest}\``,
-              ``,
-              releaseNotes ? `### Release Notes\n\n${releaseNotes}` : '',
-              ``,
-              `---`,
-              `*This issue was automatically created by the version check workflow.*`
-            ].join('\n');
-
-            // Check for existing open issue
-            const issues = await github.rest.issues.listForRepo({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              labels: 'update-available',
-            });
-
-            const existing = issues.data.find(i => i.title === title);
-
-            if (existing) {
-              await github.rest.issues.update({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: existing.number,
-                body: body,
-              });
-              console.log(`Updated issue #${existing.number}`);
-            } else {
-              // Create label if it doesn't exist
-              try {
-                await github.rest.issues.createLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  name: 'update-available',
-                  color: '0075ca',
-                  description: 'A new SFP Server version is available',
-                });
-              } catch (e) {
-                // Label may already exist
-              }
-
-              const issue = await github.rest.issues.create({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                title: title,
-                body: body,
-                labels: ['update-available'],
-              });
-              console.log(`Created issue #${issue.data.number}`);
-            }