ci: update source path

.gitea/workflows/push-develop.yml

@@ -55,7 +55,7 @@ jobs:
     runs-on: stage-gatehouse-api
     needs: build
     env:
-      COMPOSE_DIR: /home/ubuntu/secuird/gatehouse-api
+      COMPOSE_DIR: /opt/gatehouse-api
 
     steps:
       - uses: actions/checkout@v4

.gitea/workflows/push-main.yml

@@ -54,7 +54,7 @@ jobs:
     runs-on: prod-gatehouse-api
     needs: build
     env:
-      COMPOSE_DIR: /home/ubuntu/secuird/gatehouse-api  # TODO: confirm prod path
+      COMPOSE_DIR: /opt/gatehouse-api
 
     steps:
       - uses: actions/checkout@v4

deploy/ansible/group_vars/all.yml

@@ -3,6 +3,11 @@
 runner_user: gitea-runner
 runner_home: /home/gitea-runner
 
+# Base dir for app deploy targets. Each project deploys to <app_base_dir>/<project>
+# (e.g. /opt/gatehouse-api), owned by the runner so the deploy job can write the
+# compose file there. Must match COMPOSE_DIR in the project's workflow files.
+app_base_dir: /opt
+
 gitea_instance: "https://source.hawkless.id.au"
 
 # Pinned act_runner release. Bump version + sha256 together.

deploy/ansible/install-runner.yml

@@ -84,6 +84,20 @@
         mode: "0755"
       when: gitleaks_version not in (gitleaks_check.stdout | default(''))
 
+    # Deploy target for each project's compose stack. Owned by the runner so the
+    # deploy job can `cp docker-compose.yml` here; the host-managed .env lives
+    # here too. Basename matches the compose project name, preserving volumes.
+    - name: Ensure app deploy dir exists for each project
+      ansible.builtin.file:
+        path: "{{ app_base_dir }}/{{ item.project }}"
+        state: directory
+        owner: "{{ runner_user }}"
+        group: "{{ runner_user }}"
+        mode: "0755"
+      loop: "{{ runners }}"
+      loop_control:
+        label: "{{ item.project }}"
+
     - name: Install runners for each project
       ansible.builtin.include_tasks: tasks/install_project.yml
       loop: "{{ runners }}"