fix: add kubectl apply to CI workflows and add production K8s manifest

Both kub-deploy and prod-deploy were only running kubectl rollout restart,
meaning changes to the deployment manifest (env vars, resources, image tag)
were never applied to the cluster.

- Add scp + kubectl apply before rollout restart in kub-deploy.yml (staging)
- Add scp + kubectl apply before rollout restart in prod-deploy.yml (production)
- Add k8s/production/frontoffice-deployment.yaml with ASPNETCORE_ENVIRONMENT=Production
  and image tag :prod

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/kub-deploy.yml

@@ -67,8 +67,15 @@ jobs:
       - name: Deploy to Kubernetes
         run: |
           export SSHPASS="${{ secrets.SERVER_PASSWORD }}"
+
+          # Copy K8s manifests to server
+          sshpass -e scp -o StrictHostKeyChecking=no k8s/staging/frontoffice-deployment.yaml root@${{ env.K8S_SERVER }}:/tmp/frontoffice-deployment.yaml
+
+          # Apply manifests and restart
           sshpass -e ssh -o StrictHostKeyChecking=no root@${{ env.K8S_SERVER }} "
-            kubectl rollout restart deployment/frontoffice
+            kubectl apply -f /tmp/frontoffice-deployment.yaml &&
-            kubectl rollout status deployment/frontoffice --timeout=180s
+            kubectl rollout restart deployment/frontoffice &&
+            kubectl rollout status deployment/frontoffice --timeout=180s &&
+            rm -f /tmp/frontoffice-deployment.yaml
           "
           echo "✅ Deployed!"

.gitea/workflows/prod-deploy.yml

@@ -68,8 +68,15 @@ jobs:
       - name: Deploy to Production
         run: |
           export SSHPASS="${{ secrets.SERVER_PASSWORD }}"
+
+          # Copy K8s manifests to server
+          sshpass -e scp -o StrictHostKeyChecking=no k8s/production/frontoffice-deployment.yaml root@${{ env.K8S_SERVER }}:/tmp/frontoffice-deployment.yaml
+
+          # Apply manifests and restart
           sshpass -e ssh -o StrictHostKeyChecking=no root@${{ env.K8S_SERVER }} "
-            kubectl rollout restart deployment/frontoffice
+            kubectl apply -f /tmp/frontoffice-deployment.yaml &&
-            kubectl rollout status deployment/frontoffice --timeout=300s
+            kubectl rollout restart deployment/frontoffice &&
+            kubectl rollout status deployment/frontoffice --timeout=300s &&
+            rm -f /tmp/frontoffice-deployment.yaml
           "
           echo "✅ Deployed to Production!"

k8s/production/frontoffice-deployment.yaml

@@ -0,0 +1,56 @@
+---
+# FrontOffice (Blazor Server) production.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontoffice
+  namespace: default
+  labels:
+    app: frontoffice
+    environment: production
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: frontoffice
+  template:
+    metadata:
+      labels:
+        app: frontoffice
+    spec:
+      containers:
+        - name: frontoffice
+          image: 194.5.195.53:30080/admin/frontoffice:prod
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+              name: http
+          env:
+            - name: ASPNETCORE_ENVIRONMENT
+              value: "Production"
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+      imagePullSecrets:
+        - name: gitea-registry-secret
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontoffice-svc
+  namespace: default
+  labels:
+    app: frontoffice
+spec:
+  selector:
+    app: frontoffice
+  ports:
+    - port: 80
+      targetPort: 80
+      name: http
+  type: ClusterIP