Merge remote-tracking branch 'origin/dev' into dev

# Conflicts:
#	Dockerfile
#	src/components/Footer.astro
#	src/pages/index.astro
#	src/styles/components/Drinks.css
#	src/styles/components/HoverCard.css

.dockerignore

@@ -1,29 +0,0 @@
-# Ohne diese Datei wandert das komplette Repo zum Fly-Remote-Builder,
-# inklusive der ~50 MB Git-Historie und des gesamten Backends. Der
-# Frontend-Build braucht davon nichts.
-
-.git
-.gitignore
-
-node_modules
-dist
-.astro
-
-# Das Backend wird als eigene Fly-App aus backend/ heraus gebaut
-backend
-
-# Nicht vom Frontend-Build verwendet
-.woodpecker.yml
-Dockerfile.caddy
-docker-compose.yml
-pnpm-lock.yaml
-pnpm-workspace.yaml
-MIGRATION_README.md
-
-.vscode
-.idea
-.DS_Store
-
-.env
-.env.*
-*.log

.gitignore

@@ -16,10 +16,10 @@ pnpm-debug.log*
 # environment variables
 .env
 .env.production
+.env.local
 
 # macOS-specific files
 .DS_Store
 
 # jetbrains setting folder
 .idea/
-/ai/

.woodpecker.yml

@@ -1,106 +1,5 @@
 steps:
-  audit_dependencies:
+  deploy:
-    image: node:20
-    commands:
-      - npm install --package-lock-only
-      - npm audit --audit-level=moderate --json > audit-result.json 2>&1 || echo "Audit completed"
-      - npm audit --audit-level=moderate > audit-output.txt 2>&1 || echo "Audit completed"
-    # Nur wenn sich Abhaengigkeiten geaendert haben - bei reinen
-    # Inhaltsaenderungen kaeme sonst jedes Mal derselbe Bericht
-    when:
-      - branch: main
-        event: push
-        path:
-          include:
-            - 'package.json'
-            - 'package-lock.json'
-            - '.woodpecker.yml'
-          ignore_message: '[ALL]'
-
-  discord_notify_audit:
-    image: alpine:latest
-    environment:
-      DISCORD_WEBHOOK:
-        from_secret: discord_webhook
-    commands:
-      - apk add --no-cache curl jq
-      - |
-        if [ -f audit-result.json ]; then
-          TOTAL=$(jq -r '.metadata.vulnerabilities.total // 0' audit-result.json 2>/dev/null || echo "0")
-          CRITICAL=$(jq -r '.metadata.vulnerabilities.critical // 0' audit-result.json 2>/dev/null || echo "0")
-          HIGH=$(jq -r '.metadata.vulnerabilities.high // 0' audit-result.json 2>/dev/null || echo "0")
-          MODERATE=$(jq -r '.metadata.vulnerabilities.moderate // 0' audit-result.json 2>/dev/null || echo "0")
-          LOW=$(jq -r '.metadata.vulnerabilities.low // 0' audit-result.json 2>/dev/null || echo "0")
-
-          if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ] || [ "$MODERATE" -gt 0 ]; then
-            COLOR=16744448
-            STATUS="⚠️ Vulnerabilities Found"
-          else
-            COLOR=3066993
-            STATUS="✅ No Vulnerabilities"
-          fi
-
-          if [ -f audit-output.txt ]; then
-            VULNS=$(head -50 audit-output.txt | tail -40 || echo "No details")
-          else
-            VULNS="No audit output available"
-          fi
-
-          printf '%s' "$VULNS" > /tmp/vulns.txt
-
-          PAYLOAD=$(jq -n \
-            --arg title "🔒 Security Audit - Build #${CI_BUILD_NUMBER}" \
-            --arg status "$STATUS" \
-            --arg total "$TOTAL" \
-            --arg critical "$CRITICAL" \
-            --arg high "$HIGH" \
-            --arg moderate "$MODERATE" \
-            --arg low "$LOW" \
-            --arg commit "${CI_COMMIT_SHA:0:7}" \
-            --rawfile details /tmp/vulns.txt \
-            --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
-            --argjson color "$COLOR" \
-            '{
-              embeds: [{
-                title: $title,
-                description: $status,
-                color: $color,
-                fields: [
-                  { name: "Total", value: $total, inline: true },
-                  { name: "Critical", value: $critical, inline: true },
-                  { name: "High", value: $high, inline: true },
-                  { name: "Moderate", value: $moderate, inline: true },
-                  { name: "Low", value: $low, inline: true },
-                  { name: "Commit", value: ("`" + $commit + "`"), inline: true },
-                  { name: "Details", value: ("```\n" + ($details[:800]) + (if ($details | length) > 800 then "\n... (truncated)" else "" end) + "\n```"), inline: false }
-                ],
-                timestamp: $timestamp
-              }]
-            }')
-
-          curl -H "Content-Type: application/json" -X POST \
-            -d "$PAYLOAD" "$DISCORD_WEBHOOK"
-        else
-          echo "No audit results found - listing workspace files:"
-          ls -la
-        fi
-    # Gleicher Filter wie der Audit-Schritt, sonst meldet Discord bei jedem
-    # Inhalts-Commit "keine Ergebnisse gefunden"
-    when:
-      - branch: main
-        event: push
-        path:
-          include:
-            - 'package.json'
-            - 'package-lock.json'
-            - '.woodpecker.yml'
-          ignore_message: '[ALL]'
-
-  # Backend zuerst - die Admin-Seite braucht die API.
-  # Laeuft nur, wenn sich am Backend etwas geaendert hat. Die haeufigsten
-  # Commits sind Inhaltsaenderungen aus dem CMS und fassen nur src/ und
-  # public/ an - die brauchen kein Backend-Deployment.
-  deploy_backend:
     image: node:20
     environment:
       FLY_API_TOKEN:
@@ -108,122 +7,10 @@ steps:
     commands:
       - curl -L https://fly.io/install.sh | sh
       - export PATH="$HOME/.fly/bin:$PATH"
-      # aus backend/ heraus, damit Build-Kontext und Dockerfile stimmen
+      - flyctl deploy --config fly.toml --app gallus-pub
-      - cd backend && flyctl deploy --app gallus-cms-backend --remote-only
-    when:
-      - branch: main
-        event: push
-        path:
-          include:
-            - 'backend/**'
-            - '.woodpecker.yml'
-          # "[ALL]" in der Commit-Message erzwingt den vollen Durchlauf
-          ignore_message: '[ALL]'
 
-  deploy_frontend:
+when:
-    image: node:20
+  branch:
-    environment:
+    - main
-      FLY_API_TOKEN:
+  event:
-        from_secret: FLY_API_TOKEN
+    - push
-    commands:
-      - curl -L https://fly.io/install.sh | sh
-      - export PATH="$HOME/.fly/bin:$PATH"
-      - flyctl deploy --config fly.toml --app gallus-pub --remote-only
-    when:
-      - branch: main
-        event: push
-        path:
-          include:
-            - 'src/**'
-            - 'public/**'
-            - 'package.json'
-            - 'package-lock.json'
-            - 'astro.config.mjs'
-            - 'tsconfig.json'
-            - 'Dockerfile'
-            - '.dockerignore'
-            - 'fly.toml'
-            - '.woodpecker.yml'
-          ignore_message: '[ALL]'
-
-  notify_success:
-    image: alpine:latest
-    environment:
-      DISCORD_WEBHOOK:
-        from_secret: discord_webhook
-    commands:
-      - apk add --no-cache curl jq
-      - |
-        # Schreibe Commit-Message in Datei (sicher gegen Shell-Sonderzeichen)
-        printf '%s\n' "$CI_COMMIT_MESSAGE" > /tmp/commit_msg.txt
-
-        PAYLOAD=$(cat /tmp/commit_msg.txt | jq -Rs \
-          --arg title "✅ Build #${CI_BUILD_NUMBER} - Success" \
-          --arg repo "${CI_REPO}" \
-          --arg branch "${CI_COMMIT_BRANCH}" \
-          --arg commit "${CI_COMMIT_SHA:0:7}" \
-          --arg author "${CI_COMMIT_AUTHOR}" \
-          --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
-          '. as $message | {
-            embeds: [{
-              title: $title,
-              description: "Build und Deployment erfolgreich abgeschlossen!",
-              color: 3066993,
-              fields: [
-                { name: "Repository", value: $repo, inline: true },
-                { name: "Branch", value: $branch, inline: true },
-                { name: "Commit", value: ("`" + $commit + "`"), inline: true },
-                { name: "Author", value: $author, inline: true },
-                { name: "Commit Message", value: $message, inline: false }
-              ],
-              timestamp: $timestamp
-            }]
-          }')
-
-        curl -H "Content-Type: application/json" -X POST \
-          -d "$PAYLOAD" "$DISCORD_WEBHOOK"
-    when:
-      - branch: main
-        event: push
-        status: success
-
-  notify_failure:
-    image: alpine:latest
-    environment:
-      DISCORD_WEBHOOK:
-        from_secret: discord_webhook
-    commands:
-      - apk add --no-cache curl jq
-      - |
-        # Schreibe Commit-Message in Datei (sicher gegen Shell-Sonderzeichen)
-        printf '%s\n' "$CI_COMMIT_MESSAGE" > /tmp/commit_msg.txt
-
-        PAYLOAD=$(cat /tmp/commit_msg.txt | jq -Rs \
-          --arg title "❌ Build #${CI_BUILD_NUMBER} - Failure" \
-          --arg repo "${CI_REPO}" \
-          --arg branch "${CI_COMMIT_BRANCH}" \
-          --arg commit "${CI_COMMIT_SHA:0:7}" \
-          --arg author "${CI_COMMIT_AUTHOR}" \
-          --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
-          '. as $message | {
-            embeds: [{
-              title: $title,
-              description: "Build oder Deployment ist fehlgeschlagen!",
-              color: 15158332,
-              fields: [
-                { name: "Repository", value: $repo, inline: true },
-                { name: "Branch", value: $branch, inline: true },
-                { name: "Commit", value: ("`" + $commit + "`"), inline: true },
-                { name: "Author", value: $author, inline: true },
-                { name: "Commit Message", value: $message, inline: false }
-              ],
-              timestamp: $timestamp
-            }]
-          }')
-
-        curl -H "Content-Type: application/json" -X POST \
-          -d "$PAYLOAD" "$DISCORD_WEBHOOK"
-    when:
-      - branch: main
-        event: push
-        status: failure

Dockerfile

@@ -1,21 +1,29 @@
-FROM node:22-alpine AS build
+FROM node:20-alpine AS build
 
 WORKDIR /app
+
 COPY package*.json ./
-# Fallback to npm install if no lockfile is present
+RUN npm install
-RUN npm ci || npm install
+
 COPY . .
+
 RUN npm run build
 
-FROM node:22-alpine AS production
+FROM node:20-alpine AS production
 
+ENV NODE_ENV=production
 WORKDIR /app
-RUN npm install -g serve
+
-COPY --from=build /app/dist ./dist
+# Copy built app and minimal runtime files
+COPY --from=build /app/dist /app/dist
+COPY --from=build /app/package*.json /app/
+
+RUN npm pkg delete devDependencies || true
 
 EXPOSE 3000
-# Serve static files (no SPA fallback), so /admin serves dist/admin/index.html
+
-CMD ["serve", "-l", "3000", "dist"]
+# Run Astro server entry (node adapter standalone)
+CMD ["node", "dist/server/entry.mjs"]
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
   CMD wget -qO- http://localhost:3000/ || exit 1

Dockerfile.caddy

@@ -1,9 +0,0 @@
-FROM caddy:2-alpine
-
-# Embed Caddyfile directly to avoid host path issues on Windows
-RUN mkdir -p /etc/caddy \
- && printf ":80\nlog\nroute {\n  handle /api/* {\n    reverse_proxy backend:8080\n  }\n  handle {\n    reverse_proxy frontend:3000\n  }\n}\n" > /etc/caddy/Caddyfile
-
-EXPOSE 80
-
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

MIGRATION_README.md

@@ -1,142 +0,0 @@
-# Migration der alten Events und Gallery-Bilder
-
-## ✅ Was wurde migriert?
-
-### Events (7 Stück):
-- Karaoke (wiederkehrend)
-- Pub Quiz (wiederkehrend)
-- Schlager Hüttenzauber Karaoke
-- Adventskalender
-- Santa Karaoke-Party
-- Weihnachtsferien
-- Neujahrs-Apero
-
-### Gallery-Bilder (9 Stück):
-- Gallery1.webp bis Gallery9.webp
-
-## 📁 Wo liegen die Bilder?
-
-Alle Bilder wurden konvertiert und liegen jetzt in:
-- **Events:** `backend/data/images/events/`
-- **Gallery:** `backend/data/images/gallery/`
-
-Die Bilder wurden automatisch:
-- Von PNG/JPG/JPEG zu WebP konvertiert
-- Auf max. 1600px Breite skaliert
-- Mit 85% Qualität optimiert
-
-## 🚀 Deployment-Schritte
-
-### 1. Lokale Vorbereitung (bereits erledigt ✓)
-- ✓ Migrations-Script erstellt
-- ✓ Bilder konvertiert und in `backend/data/images/` kopiert
-- ✓ Public API-Endpunkte erstellt (`/api/events/public`, `/api/gallery/public`)
-- ✓ Frontend aktualisiert, um Events und Gallery dynamisch zu laden
-
-### 2. Auf Fly.io deployen
-
-Alle Änderungen committen und pushen:
-```bash
-git add .
-git commit -m "feat: Migrate old events and gallery images to CMS"
-git push origin main
-```
-
-Woodpecker CI wird automatisch beide Services deployen.
-
-### 3. Nach dem ersten Deploy - Datenbank initialisieren
-
-**Wichtig:** Die Bilder sind bereits im Repository in `backend/data/images/`, aber die Datenbank muss noch mit den Event- und Gallery-Einträgen befüllt werden.
-
-#### Via fly ssh (Empfohlen):
-
-```bash
-# In das Backend einloggen
-fly ssh console -a gallus-cms-backend
-
-# Prüfen ob Bilder da sind
-ls -la /app/data/images/events/
-ls -la /app/data/images/gallery/
-
-# Migrations-Script ausführen
-cd /app
-npm run migrate:old-data
-```
-
-#### Alternative: Manuell via Admin-Panel
-
-1. Gehe zu https://gallus-pub.ch/admin
-2. Melde dich an
-3. Für jedes Event:
-   - Klicke auf "Neues Event"
-   - Gib Titel, Datum und Beschreibung ein
-   - Statt Bild hochzuladen, trage manuell die imageUrl ein:
-     - z.B. `/images/events/event_karaoke.webp`
-   - Speichere das Event
-
-## 🔍 Verifikation
-
-Nach dem Deployment prüfen:
-
-1. **Frontend:** https://gallus-pub.ch/
-   - Events sollten angezeigt werden
-   - Gallery sollte Bilder zeigen
-
-2. **Admin:** https://gallus-pub.ch/admin
-   - Events können bearbeitet werden
-   - Neue Events können hinzugefügt werden
-
-3. **Backend Health:** https://cms.gallus-pub.ch/health
-   - Status sollte "ok" sein
-
-## 📝 Event-Daten für manuelles Einfügen
-
-Falls du die Events manuell via Admin-Panel einfügen möchtest:
-
-### Karaoke
-- **Titel:** Karaoke
-- **Datum:** 2025-12-31
-- **Beschreibung:** Bei uns gibt es Karaoke Mi-Sa!! <br>Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>
-- **Bild-URL:** `/images/events/event_karaoke.webp`
-
-### Pub Quiz
-- **Titel:** Pub Quiz
-- **Datum:** 2025-12-31
-- **Beschreibung:** Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>Auch Einzelpersonen sind herzlich willkommen! <br>*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF
-- **Bild-URL:** `/images/events/event_pub-quiz.webp`
-
-### Schlager Hüttenzauber Karaoke
-- **Titel:** Schlager Hüttenzauber Karaoke
-- **Datum:** 2025-11-27
-- **Beschreibung:** Ab 19:00 Uhr Eintritt ist Frei! Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>
-- **Bild-URL:** `/images/events/event_schlager-karaoke.webp`
-
-### Adventskalender
-- **Titel:** Adventskalender
-- **Datum:** 2025-12-20
-- **Beschreibung:** Jeden Tag neue Überraschungen! Check unsere Social Media Stories!
-- **Bild-URL:** `/images/events/event_advents-kalender.webp`
-
-### Santa Karaoke-Party
-- **Titel:** Santa Karaoke-Party
-- **Datum:** 2025-12-06
-- **Beschreibung:** 🤶🏻🎅🏻Komme als Weihnachts-Mann/-Frau und bekomme einen Shot auf's Haus!🤶🏻🎅🏻
-- **Bild-URL:** `/images/events/event_santa_karaoke.webp`
-
-### Weihnachtsferien
-- **Titel:** Weihnachtsferien
-- **Datum:** 2025-12-21
-- **Beschreibung:** Wir sind ab 02.01.2026 wieder wie gewohnt für euch da! 🍀. <br> Für Anfragen WA <a href="tel:+41772322770">077 232 27 70</a> Antwort innerhalb 48h
-- **Bild-URL:** `/images/events/event_ferien.webp`
-
-### Neujahrs-Apero
-- **Titel:** Neujahrs-Apero
-- **Datum:** 2026-01-02
-- **Beschreibung:** 18:00-20:00 Uhr
-- **Bild-URL:** `/images/events/event_neujahrs-apero.webp`
-
-## ⚠️ Wichtige Hinweise
-
-1. **Bilder sind im Volume persistent:** Alle Bilder in `/app/data/` bleiben bei Restarts erhalten
-2. **Datenbank ist persistent:** Die SQLite-DB in `/app/data/gallus_cms.db` bleibt erhalten
-3. **Alte Bilder in `public/images/`:** Die alten Original-Bilder bleiben im Frontend-Repository, werden aber nicht mehr verwendet

README.md

@@ -1,48 +1,55 @@
-# Astro Starter Kit: Minimal
+# Gallus Pub Website
+
+This is the Gallus Pub website built with Astro. It includes an admin area at `/admin` for editing content (events, gallery, texts). Changes are committed back to the Git repository via the Gitea API which triggers your Woodpecker + Fly.io deployment pipeline.
+
+## Local development
+
+To run the site locally with OAuth login (Gitea):
+
+1. Copy the example env file and fill values:
+   ```bash
+   cp .env.example .env.local
+   ```
+   - Create a Gitea OAuth application with Redirect URI: `http://localhost:4321/api/auth/callback`.
+   - Set `OAUTH_CLIENT_ID` and `OAUTH_CLIENT_SECRET` from Gitea.
+   - Set `GITEA_OWNER`, `GITEA_REPO`, and a `GITEA_TOKEN` (PAT) with write access to the repo.
+   - Generate random secrets for sessions/CSRF (e.g. `openssl rand -hex 32`).
+
+2. Install dependencies:
+   ```bash
+   npm install
+   ```
+
+3. Start dev server using your local env file:
+   ```bash
+   npm run dev:local
+   ```
+   The site runs at http://localhost:4321. Visit http://localhost:4321/admin to log in via Gitea OAuth.
+
+Notes:
+- If OAuth variables are missing or malformed, the auth endpoints return a clear 500 with guidance instead of crashing.
+- Production secrets are configured on Fly.io; `.env.local` is ignored by Git.
+
+## Project structure
 
-```sh
-npm create astro@latest -- --template minimal
 ```
-
-[![Open in StackBlitz](https://developer.stackblitz.com/img/open_in_stackblitz.svg)](https://stackblitz.com/github/withastro/astro/tree/latest/examples/minimal)
-[![Open with CodeSandbox](https://assets.codesandbox.io/github/button-edit-lime.svg)](https://codesandbox.io/p/sandbox/github/withastro/astro/tree/latest/examples/minimal)
-[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/withastro/astro?devcontainer_path=.devcontainer/minimal/devcontainer.json)
-
-> 🧑‍🚀 **Seasoned astronaut?** Delete this file. Have fun!
-
-## 🚀 Project Structure
-
-Inside of your Astro project, you'll see the following folders and files:
-
-```text
 /
-├── public/
+├── public/              # static assets
 ├── src/
-│   └── pages/
+│   ├── content/         # editable JSON content (events, gallery)
-│       └── index.astro
+│   ├── pages/           # Astro pages, includes /admin and API routes
+│   ├── components/      # UI components
+│   └── utils/           # session helpers
+├── .env.example         # template for local env
+├── fly.toml             # Fly.io config
+├── Dockerfile
 └── package.json
 ```
 
-Astro looks for `.astro` or `.md` files in the `src/pages/` directory. Each page is exposed as a route based on its file name.
+## Commands
 
-There's nothing special about `src/components/`, but that's where we like to put any Astro/React/Vue/Svelte/Preact components.
+- `npm install` – install deps
-
+- `npm run dev` – dev server without loading .env.local (expects env to be present in the shell)
-Any static assets, like images, can be placed in the `public/` directory.
+- `npm run dev:local` – dev server loading `.env.local` via dotenv-cli
-
+- `npm run build` – production build (SSR via @astrojs/node)
-## 🧞 Commands
+- `npm run preview` – preview the production build
-
-All commands are run from the root of the project, from a terminal:
-
-| Command                   | Action                                           |
-| :------------------------ | :----------------------------------------------- |
-| `npm install`             | Installs dependencies                            |
-| `npm run dev`             | Starts local dev server at `localhost:4321`      |
-| `npm run build`           | Build your production site to `./dist/`          |
-| `npm run preview`         | Preview your build locally, before deploying     |
-| `npm run astro ...`       | Run CLI commands like `astro add`, `astro check` |
-| `npm run astro -- --help` | Get help using the Astro CLI                     |
-
-## 👀 Want to learn more?
-
-Feel free to check [our documentation](https://docs.astro.build) or jump into our [Discord server](https://astro.build/chat).
-# Test commit to trigger Woodpecker

astro.config.mjs

@@ -1,5 +1,9 @@
 // @ts-check
 import { defineConfig } from 'astro/config';
+import node from '@astrojs/node';
 
 // https://astro.build/config
-export default defineConfig({});
+export default defineConfig({
+  output: 'server',
+  adapter: node({ mode: 'standalone' })
+});

backend/.dockerignore

@@ -1,20 +0,0 @@
-node_modules
-dist
-.env
-.env.local
-.env.*.local
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.git
-.gitignore
-.vscode
-.idea
-.DS_Store
-*.md
-!README.md
-tmp
-/tmp
-coverage
-.nyc_output

backend/.env.example

@@ -1,29 +0,0 @@
-# Database (SQLite)
-DATABASE_PATH=./data/gallus_cms.db
-
-# Gitea OAuth
-GITEA_URL=https://git.bookageek.ch
-GITEA_CLIENT_ID=your-oauth-client-id-here
-GITEA_CLIENT_SECRET=your-oauth-client-secret-here
-GITEA_REDIRECT_URI=http://localhost:3000/api/auth/callback
-GITEA_ALLOWED_USERS=sabrina,raphael,admin
-
-# Git Configuration (use Gitea repository)
-GIT_REPO_URL=https://git.bookageek.ch/yourusername/Gallus_Pub.git
-GIT_TOKEN=your-gitea-personal-access-token-here
-GIT_USER_NAME=Gallus CMS
-GIT_USER_EMAIL=[email protected]
-GIT_WORKSPACE_DIR=./data/workspace
-
-# JWT & Session
-JWT_SECRET=your-super-secret-jwt-key-change-this
-SESSION_SECRET=your-session-secret-change-this
-
-# Server
-PORT=3000
-NODE_ENV=development
-CORS_ORIGIN=http://localhost:5173
-FRONTEND_URL=http://localhost:5173
-
-# Upload
-MAX_FILE_SIZE=5242880

backend/.env.local

@@ -1,34 +0,0 @@
-# Local development environment for Gallus CMS Backend
-
-# Database
-DB_CLIENT=sqlite
-DATABASE_URL=
-DATABASE_PATH=./data/gallus_cms.db
-
-# Gitea OAuth
-GITEA_URL=https://git.bookageek.ch
-GITEA_CLIENT_ID=bcddfe24-3099-41bc-bb7a-6c6d80bd9048
-GITEA_CLIENT_SECRET=gto_me7hsswrsdq2ygey65edlc6qa2xxr3i5nrq7q4jvjwx654ytrh7q
-# Frontend proxy callback in local dev
-GITEA_REDIRECT_URI=http://localhost:4321/api/auth/callback
-GITEA_ALLOWED_USERS=Gallus-maintanance
-
-# Git repository for content versioning
-GIT_REPO_URL=https://git.bookageek.ch/Kenzo/Gallus_Pub
-GIT_TOKEN=1482ae7bcdbd7610bf0cfd468b6757722d16a2a2
-GIT_USER_NAME=Gallus-maintanance
-GIT_USER_EMAIL=[email protected]
-GIT_WORKSPACE_DIR=./data/workspace
-
-# JWT & Session secrets (use strong random strings in real deployments)
-JWT_SECRET=local-dev-jwt-secret-please-change-1234567890abcdef
-SESSION_SECRET=local-dev-session-secret-please-change-abcdef1234567890
-
-# Server & CORS
-PORT=3000
-NODE_ENV=development
-FRONTEND_URL=http://localhost:4321
-CORS_ORIGIN=http://localhost:4321
-
-# Upload limits
-MAX_FILE_SIZE=5242880

backend/.gitignore

@@ -1,12 +0,0 @@
-node_modules
-dist
-.env
-*.log
-.DS_Store
-/tmp
-/data/*.db
-/data/*.db-wal
-/data/*.db-shm
-/data/workspace
-# Allow images to be committed
-!/data/images

backend/DEPLOYMENT.md

@@ -1,195 +0,0 @@
-# Deployment Guide
-
-## Prerequisite
-
-1. Fly.io CLI installed: `curl -L https://fly.io/install.sh | sh`
-2. Fly.io account: `flyctl auth login`
-3. Gitea OAuth app configured at git.bookageek.ch
-4. Gitea Personal Access Token for git operations
-
-## Initial Setup
-
-### 1. Create Fly.io App
-
-```bash
-cd backend
-flyctl apps create gallus-cms-backend
-```
-
-### 2. Create Volume for Data (SQLite DB + Git Workspace)
-
-```bash
-flyctl volumes create gallus_data --size 2 --region ams
-```
-
-This volume will store:
-- SQLite database at `/app/data/gallus_cms.db`
-- Git workspace at `/app/data/workspace`
-
-### 3. Set Secrets
-
-```bash
-flyctl secrets set \
-  GITEA_CLIENT_ID="<your-gitea-oauth-client-id>" \
-  GITEA_CLIENT_SECRET="<your-gitea-oauth-client-secret>" \
-  GIT_TOKEN="<your-gitea-personal-access-token>" \
-  JWT_SECRET="$(openssl rand -base64 32)" \
-  SESSION_SECRET="$(openssl rand -base64 32)" \
-  GIT_REPO_URL="https://git.bookageek.ch/yourusername/Gallus_Pub.git" \
-  GIT_USER_NAME="Gallus CMS" \
-  GIT_USER_EMAIL="[email protected]" \
-  GITEA_REDIRECT_URI="https://gallus-cms-backend.fly.dev/api/auth/callback" \
-  FRONTEND_URL="https://cms.galluspub.ch" \
-  CORS_ORIGIN="https://cms.galluspub.ch" \
-  GITEA_ALLOWED_USERS="sabrina,raphael"
-```
-
-### 4. Deploy
-
-```bash
-flyctl deploy
-```
-
-### 5. Initialize Database
-
-After first deployment, SSH into the container and run migrations:
-```bash
-flyctl ssh console
-cd /app
-node dist/index.js  # Start once to create the database file
-# Then exit (Ctrl+C) and run migrations
-npm run db:migrate
-exit
-```
-
-Or simply let the app run - the database will be created automatically on first start.
-
-## Gitea OAuth Configuration
-
-Update your Gitea OAuth application redirect URI to include:
-```
-https://gallus-cms-backend.fly.dev/api/auth/callback
-```
-
-## Useful Commands
-
-### View Logs
-```bash
-flyctl logs
-```
-
-### Check Status
-```bash
-flyctl status
-```
-
-### SSH into Container
-```bash
-flyctl ssh console
-```
-
-### Scale App
-```bash
-flyctl scale count 2
-```
-
-### View Secrets
-```bash
-flyctl secrets list
-```
-
-### Update a Secret
-```bash
-flyctl secrets set KEY=VALUE
-```
-
-### Restart App
-```bash
-flyctl apps restart
-```
-
-## Monitoring
-
-### Health Check
-```bash
-curl https://gallus-cms-backend.fly.dev/health
-```
-
-### View Metrics
-```bash
-flyctl dashboard
-```
-
-## Troubleshooting
-
-### Deployment Fails
-- Check logs: `flyctl logs`
-- Verify all secrets are set: `flyctl secrets list`
-- Ensure Docker builds locally: `docker build -t test .`
-
-### OAuth Not Working
-- Verify GITEA_REDIRECT_URI matches Gitea settings exactly
-- Check CORS_ORIGIN includes frontend domain
-- Review logs for authentication errors
-
-### Git Push Fails
-- Verify GIT_TOKEN has correct permissions
-- Check GIT_REPO_URL is accessible
-- Ensure workspace volume is mounted
-
-### Database Issues
-- Verify DATABASE_PATH is set correctly
-- Check volume is mounted: `flyctl ssh console` then `ls -la /app/data`
-- Verify database file permissions
-- Run migrations if needed: `flyctl ssh console` then `npm run db:migrate`
-
-## Cost Optimization
-
-Current configuration uses:
-- `shared-cpu-1x` with 512MB RAM
-- Auto-suspend when idle
-- 2GB volume for SQLite database + git workspace
-
-Estimated cost: ~$5-10/month (no separate database cost with SQLite!)
-
-## Updating
-
-To deploy updates:
-```bash
-git pull
-flyctl deploy
-```
-
-## Rollback
-
-To rollback to previous version:
-```bash
-flyctl releases list
-flyctl releases rollback <version-number>
-```
-
-## Environment Variables
-
-All sensitive environment variables should be set as Fly.io secrets (not in fly.toml):
-
-Note: DATABASE_PATH and GIT_WORKSPACE_DIR are set in fly.toml as they're not sensitive.
-- `GITEA_CLIENT_ID` - OAuth client ID
-- `GITEA_CLIENT_SECRET` - OAuth client secret
-- `GIT_TOKEN` - Gitea personal access token
-- `JWT_SECRET` - JWT signing secret
-- `SESSION_SECRET` - Session cookie secret
-- `GIT_REPO_URL` - Full git repository URL
-- `GITEA_REDIRECT_URI` - OAuth callback URL
-- `FRONTEND_URL` - Frontend application URL
-- `CORS_ORIGIN` - Allowed CORS origin
-- `GITEA_ALLOWED_USERS` - Comma-separated list of allowed usernames
-
-## Security Checklist
-
-- [ ] All secrets set and not exposed in logs
-- [ ] HTTPS enforced (fly.toml: force_https = true)
-- [ ] CORS configured correctly
-- [ ] GITEA_ALLOWED_USERS whitelist configured
-- [ ] Database backups enabled
-- [ ] Health checks configured
-- [ ] Monitoring and alerts set up

backend/Dockerfile

@@ -1,61 +0,0 @@
-# Multi-stage build for Gallus CMS Backend
-
-# Stage 1: Builder
-# Hier werden die nativen Module EINMAL uebersetzt. Vorher lief npm ci in
-# beiden Stages, better-sqlite3 wurde also doppelt kompiliert.
-FROM node:20-alpine AS builder
-
-WORKDIR /app
-
-# Nur fuer better-sqlite3 - fuer musl gibt es davon keine Fertigbauten.
-# sharp ab 0.33 bringt eigene Binaries samt libvips mit, vips-dev wird
-# dadurch nicht mehr gebraucht.
-RUN apk add --no-cache python3 make g++
-
-# Eigener Layer: bleibt im Cache, solange sich das Lockfile nicht aendert
-COPY package*.json ./
-RUN npm ci
-
-COPY . .
-
-RUN npm run build
-
-# Dev-Abhaengigkeiten entfernen. Was uebrig bleibt, ist fertig uebersetzt
-# und wandert unveraendert ins Laufzeit-Image.
-RUN npm prune --omit=dev
-
-# Stage 2: Production
-FROM node:20-alpine
-
-WORKDIR /app
-
-# git fuer simple-git, sqlite fuer die CLI. Keine Build-Werkzeuge mehr -
-# die blieben vorher als Layer im Image liegen, auch nach dem apk del.
-RUN apk add --no-cache git sqlite
-
-COPY --from=builder /app/package*.json ./
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/migrate-production.js ./migrate-production.js
-COPY --from=builder /app/data/images ./data/images
-
-# Create directories and ensure proper permissions
-RUN mkdir -p /app/workspace /app/data && chown -R node:node /app
-
-# Switch to non-root user
-USER node
-
-# Expose port
-EXPOSE 8080
-
-# Set environment
-ENV NODE_ENV=production
-ENV PORT=8080
-ENV DATABASE_PATH=/app/data/gallus_cms.db
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:8080/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
-
-# Run DB migrations if present, then start application
-CMD ["/bin/sh", "-lc", "mkdir -p /app/data/images/events /app/data/images/gallery && [ -f dist/migrate.js ] && node dist/migrate.js || true; node dist/index.js"]

backend/README.md

@@ -1,55 +0,0 @@
-# Gallus Pub CMS Backend
-
-Headless CMS backend for managing Gallus Pub website content with Gitea OAuth authentication.
-
-## Setup
-
-1. Install dependencies:
-```bash
-npm install
-```
-
-2. Create `.env` file from `.env.example`:
-```bash
-cp .env.example .env
-```
-
-3. Update environment variables in `.env`:
-   - Set Gitea OAuth credentials
-   - Set Git repository URL and token
-   - JWT secrets are already generated
-
-4. Create data directory and run migrations:
-```bash
-mkdir -p data
-```
-
-5. Generate and run migrations:
-```bash
-npm run db:generate
-npm run db:migrate
-```
-
-6. Start development server:
-```bash
-npm run dev
-```
-
-Server will run at http://localhost:3000
-
-## Available Scripts
-
-- `npm run dev` - Start development server with watch mode
-- `npm run build` - Build for production
-- `npm run start` - Start production server
-- `npm run db:generate` - Generate database migrations
-- `npm run db:migrate` - Run database migrations
-- `npm run db:studio` - Open Drizzle Studio
-
-## Documentation
-
-See parent directory for complete documentation:
-- `CMS_CONCEPT.md` - System architecture
-- `CMS_GITEA_AUTH.md` - Authentication details
-- `CMS_IMPLEMENTATION_EXAMPLE.md` - Code examples
-- `CMS_SETUP_GUIDE.md` - Deployment guide

backend/SETUP_QUICK_START.md

@@ -1,216 +0,0 @@
-# Quick Start Guide - SQLite Version
-
-## ✅ Migration Complete: PostgreSQL → SQLite
-
-The backend now uses **SQLite** instead of PostgreSQL for simplified deployment and lower costs.
-
-## 🚀 Quick Start (3 Steps)
-
-### 1. Configure Environment
-
-Edit `.env` file (already created):
-```bash
-# Required: Update these values
-GITEA_CLIENT_ID=<your-gitea-oauth-client-id>
-GITEA_CLIENT_SECRET=<your-gitea-oauth-client-secret>
-GIT_REPO_URL=https://git.bookageek.ch/<yourusername>/Gallus_Pub.git
-GIT_TOKEN=<your-gitea-personal-access-token>
-GITEA_ALLOWED_USERS=sabrina,raphael
-
-# Already set (JWT secrets generated)
-JWT_SECRET=dOrvUqifjBLvk68kkDOvWPQper/gjsNMlAbWlVBQIrc=
-SESSION_SECRET=SD0ZrvLkv9GrtI8+3GDkxZXA1UnCN4CE3c4+2vA/fIM=
-
-# Database (SQLite - no changes needed)
-DATABASE_PATH=./data/gallus_cms.db
-```
-
-### 2. Initialize Database
-
-```bash
-# Generate migration files from schema
-pnpm run db:generate
-
-# Run migrations to create tables
-pnpm run db:migrate
-```
-
-### 3. Start Development Server
-
-```bash
-pnpm run dev
-```
-
-Server will start at **http://localhost:3000**
-
-## 📝 What Changed?
-
-### Before (PostgreSQL)
-- Required PostgreSQL installation
-- Separate database service
-- Connection string configuration
-- ~$15/month hosting cost on Fly.io
-
-### After (SQLite)
-- Single file database (`./data/gallus_cms.db`)
-- No separate database service needed
-- Works out of the box
-- **$0 database cost** (included in app volume)
-
-## 🗂️ Database Location
-
-- **Local:** `./data/gallus_cms.db`
-- **Production (Fly.io):** `/app/data/gallus_cms.db` (on persistent volume)
-- **Git Workspace:** Same `data/` directory
-
-## 🧪 Test Authentication Flow
-
-1. Make sure you have Gitea OAuth credentials configured
-2. Start dev server: `pnpm run dev`
-3. Visit: http://localhost:3000/api/auth/gitea
-4. Login with your Gitea credentials
-5. Should redirect back with JWT token
-
-## 📚 Available Endpoints
-
-### Health Check
-```bash
-curl http://localhost:3000/health
-```
-
-### OAuth Flow
-```
-GET /api/auth/gitea - Initiate OAuth
-GET /api/auth/callback - OAuth callback
-GET /api/auth/me - Get current user (requires JWT)
-```
-
-### Content Management (all require JWT)
-```
-GET/POST/PUT/DELETE /api/events
-GET/POST/PUT/DELETE /api/gallery
-GET/PUT /api/content/:section
-GET/PUT /api/settings/:key
-POST /api/publish
-```
-
-## 🔐 Getting Gitea OAuth Credentials
-
-1. Go to https://git.bookageek.ch/user/settings/applications
-2. Click "Manage OAuth2 Applications"
-3. Create new OAuth2 application:
-   - **Name:** Gallus Pub CMS
-   - **Redirect URI:** `http://localhost:3000/api/auth/callback`
-   - **Confidential:** Yes
-4. Copy Client ID and Client Secret to `.env`
-
-## 🎫 Getting Gitea Personal Access Token
-
-1. Go to https://git.bookageek.ch/user/settings/applications
-2. Generate New Token
-3. **Name:** Gallus CMS Backend
-4. **Scopes:** Select `repo` (full repository access)
-5. Copy token to `.env` as `GIT_TOKEN`
-
-## 📦 Project Structure
-
-```
-backend/
-├── data/                   # SQLite database & git workspace (gitignored)
-│   ├── gallus_cms.db      # Database file
-│   └── workspace/         # Git repository clone
-├── src/
-│   ├── config/
-│   │   ├── database.ts    # SQLite connection (updated)
-│   │   └── env.ts         # DATABASE_PATH instead of URL
-│   ├── db/
-│   │   └── schema.ts      # SQLite schema (updated)
-│   ├── routes/            # API routes
-│   ├── services/          # Core services
-│   └── index.ts           # Main server
-├── .env                   # Your configuration
-├── package.json           # Updated with better-sqlite3
-└── drizzle.config.ts      # SQLite dialect
-```
-
-## ⚙️ Scripts
-
-```bash
-pnpm install       # Install dependencies (done)
-pnpm run dev       # Start dev server with watch
-pnpm run build     # Build TypeScript
-pnpm run start     # Start production server
-pnpm run db:generate  # Generate migrations
-pnpm run db:migrate   # Run migrations
-pnpm run db:studio    # Open Drizzle Studio
-```
-
-## 🚀 Deploy to Fly.io
-
-See `DEPLOYMENT.md` for full deployment guide.
-
-**Quick version:**
-```bash
-# Create volume for database & git workspace
-flyctl volumes create gallus_data --size 2 --region ams
-
-# Set secrets
-flyctl secrets set GITEA_CLIENT_ID=... GITEA_CLIENT_SECRET=... # etc
-
-# Deploy
-flyctl deploy
-```
-
-**Cost:** ~$5-10/month (no separate database!)
-
-## 🐛 Troubleshooting
-
-### "tsx: command not found"
-```bash
-pnpm install
-```
-
-### "DATABASE_PATH not set"
-Check `.env` file exists and has `DATABASE_PATH=./data/gallus_cms.db`
-
-### "Database file not found"
-```bash
-mkdir -p data
-pnpm run db:migrate
-```
-
-### "better-sqlite3" build errors
-Make sure you have build tools:
-- **Linux:** `apt-get install python3 make g++`
-- **macOS:** Install Xcode Command Line Tools
-- **Windows:** Install windows-build-tools
-
-Then rebuild:
-```bash
-pnpm rebuild better-sqlite3
-```
-
-## ✨ Benefits of SQLite
-
-1. **Simpler** - No database server to manage
-2. **Faster** - No network overhead
-3. **Portable** - Single file, easy backups
-4. **Cost-effective** - No hosting fees
-5. **Perfect fit** - Low concurrency, simple queries
-
-## 📖 Documentation
-
-- `SQLITE_MIGRATION.md` - Detailed migration notes
-- `DEPLOYMENT.md` - Fly.io deployment guide
-- `README.md` - General setup instructions
-- `CMS_GITEA_AUTH.md` - OAuth authentication details (parent dir)
-- `CMS_CONCEPT.md` - Full system architecture (parent dir)
-
-## ✅ Ready to Go!
-
-Your backend is now configured for SQLite. Just:
-1. Add your Gitea credentials to `.env`
-2. Run `pnpm run db:generate && pnpm run db:migrate`
-3. Start with `pnpm run dev`
-
-Happy coding! 🎉

backend/SQLITE_MIGRATION.md

@@ -1,217 +0,0 @@
-# SQLite Migration Summary
-
-## Changes Made
-
-The backend has been migrated from PostgreSQL to SQLite for both local development and production (Fly.io).
-
-### Benefits of SQLite
-
-1. **Simplified Deployment** - No separate database service needed
-2. **Lower Cost** - Save ~$15/month (no Postgres hosting)
-3. **Easier Development** - No need to install/run PostgreSQL locally
-4. **Single File Database** - Easy backups and migrations
-5. **Perfect for this use case** - Low concurrent writes, simple queries
-
-## Modified Files
-
-### Dependencies
-- **package.json**
-  - Removed: `pg`, `@types/pg`
-  - Added: `better-sqlite3`, `@types/better-sqlite3`
-
-### Database Configuration
-- **src/config/database.ts**
-  - Changed from `drizzle-orm/node-postgres` to `drizzle-orm/better-sqlite3`
-  - Uses `DATABASE_PATH` instead of `DATABASE_URL`
-  - Enabled WAL mode for better concurrent access
-
-- **src/config/env.ts**
-  - Changed `DATABASE_URL` to `DATABASE_PATH`
-  - Default: `./data/gallus_cms.db`
-
-- **src/db/schema.ts**
-  - Changed from `pgTable` to `sqliteTable`
-  - Changed `uuid()` to `text()` with `crypto.randomUUID()`
-  - Changed `jsonb()` to `text(..., { mode: 'json' })`
-  - Changed `timestamp()` to `integer(..., { mode: 'timestamp' })`
-  - Changed `boolean()` to `integer(..., { mode: 'boolean' })`
-  - Uses `sql\`(unixepoch())\`` for default timestamps
-
-- **drizzle.config.ts**
-  - Changed dialect from `postgresql` to `sqlite`
-  - Uses `DATABASE_PATH` instead of `DATABASE_URL`
-
-### Environment Files
-- **.env** and **.env.example**
-  - Changed `DATABASE_URL=postgresql://...` to `DATABASE_PATH=./data/gallus_cms.db`
-  - Changed `GIT_WORKSPACE_DIR=/tmp/gallus-repo` to `./data/workspace`
-
-### Docker Configuration
-- **Dockerfile**
-  - Added build tools for `better-sqlite3` native module (python3, make, g++)
-  - Added `sqlite` CLI tool
-  - Creates `/app/data` directory for database
-  - Sets `DATABASE_PATH=/app/data/gallus_cms.db`
-  - Proper permissions for non-root user
-
-- **fly.toml**
-  - Added `DATABASE_PATH` and `GIT_WORKSPACE_DIR` to [env]
-  - Changed volume mount from `gallus_repo_workspace` to `gallus_data`
-  - Mount destination: `/app/data` (contains both DB and git workspace)
-
-### Documentation
-- **README.md** - Updated setup instructions
-- **DEPLOYMENT.md** - Removed Postgres setup, updated volume creation
-- **SQLITE_MIGRATION.md** - This file!
-
-## Local Development
-
-### Setup
-```bash
-# Dependencies already installed
-pnpm install
-
-# Create data directory (done)
-mkdir -p data
-
-# Database will be created automatically at ./data/gallus_cms.db
-```
-
-### Generate and Run Migrations
-```bash
-# Generate migration files from schema
-pnpm run db:generate
-
-# Run migrations to create tables
-pnpm run db:migrate
-```
-
-### Start Development Server
-```bash
-pnpm run dev
-```
-
-The database file will be created at `./data/gallus_cms.db` on first run.
-
-## Production (Fly.io)
-
-### Volume Setup
-```bash
-# Create single volume for both database and git workspace
-flyctl volumes create gallus_data --size 2 --region ams
-```
-
-### Environment Variables
-Set in fly.toml (non-sensitive):
-- `DATABASE_PATH=/app/data/gallus_cms.db`
-- `GIT_WORKSPACE_DIR=/app/data/workspace`
-
-Set as secrets (sensitive):
-- All other env vars (OAuth credentials, tokens, etc.)
-
-### Deployment
-```bash
-flyctl deploy
-```
-
-Database will be created automatically on first start. No need for separate database service!
-
-## Database Location
-
-### Local Development
-- **Database:** `./data/gallus_cms.db`
-- **WAL files:** `./data/gallus_cms.db-wal`, `./data/gallus_cms.db-shm`
-- **Git workspace:** `./data/workspace/`
-
-### Production (Fly.io)
-- **Database:** `/app/data/gallus_cms.db` (on volume)
-- **Git workspace:** `/app/data/workspace/` (on volume)
-- **Volume name:** `gallus_data` (2GB)
-
-## Backup Strategy
-
-### Manual Backup
-```bash
-# Local
-cp data/gallus_cms.db data/gallus_cms.backup.db
-
-# Production (Fly.io)
-flyctl ssh console
-sqlite3 /app/data/gallus_cms.db ".backup /app/data/backup.db"
-# Then copy back: flyctl ssh sftp get /app/data/backup.db
-```
-
-### Automated Backup (Optional)
-Consider setting up a cron job or Fly.io machine to periodically:
-1. Create SQLite backup
-2. Upload to S3/Backblaze/etc.
-
-## Performance Notes
-
-SQLite is perfect for this use case because:
-- **Low write concurrency** - Single admin user making changes
-- **Read-heavy** - Mostly reading content for publish operations
-- **Small dataset** - Events, gallery images, content sections
-- **Simple queries** - No complex joins or aggregations
-
-WAL mode is enabled for:
-- Better concurrent read access
-- Safer writes (crash recovery)
-- Improved performance
-
-## Migration from Existing Data
-
-If you had PostgreSQL data to migrate:
-
-1. Export from Postgres:
-```sql
-\copy events TO 'events.csv' CSV HEADER;
-\copy gallery_images TO 'gallery.csv' CSV HEADER;
--- etc.
-```
-
-2. Import to SQLite:
-```sql
-.mode csv
-.import events.csv events
-.import gallery.csv gallery_images
--- etc.
-```
-
-## Known Limitations
-
-1. **No native UUID type** - Using TEXT with UUID format
-2. **No native JSON type** - Using TEXT with JSON serialization (Drizzle handles this)
-3. **No native TIMESTAMP** - Using INTEGER with Unix epoch (Drizzle handles this)
-4. **Single writer** - Only one write transaction at a time (not an issue for this use case)
-
-## Troubleshooting
-
-### "Database is locked" error
-- WAL mode should prevent this
-- Check if multiple processes are accessing the database
-- Ensure proper file permissions
-
-### Native module build errors
-- Make sure build tools are installed: `apt-get install python3 make g++` (Linux)
-- On Alpine: `apk add python3 make g++`
-- Try rebuilding: `pnpm rebuild better-sqlite3`
-
-### Database file not found
-- Check `DATABASE_PATH` is set correctly
-- Ensure `data/` directory exists
-- Check file permissions
-
-## Next Steps
-
-1. ✅ Update dependencies
-2. ✅ Update database configuration
-3. ✅ Update schema
-4. ✅ Update Docker configuration
-5. ⏳ Generate migrations: `pnpm run db:generate`
-6. ⏳ Run migrations: `pnpm run db:migrate`
-7. ⏳ Test development server: `pnpm run dev`
-8. ⏳ Test publish flow
-9. ⏳ Deploy to Fly.io
-
-The migration is complete! Just need to generate/run migrations and test.

backend/drizzle.config.ts

@@ -1,10 +0,0 @@
-import type { Config } from 'drizzle-kit';
-
-export default {
-  schema: './src/db/schema.ts',
-  out: './src/db/migrations',
-  dialect: 'sqlite',
-  dbCredentials: {
-    url: process.env.DATABASE_PATH || './data/gallus_cms.db',
-  },
-} satisfies Config;

backend/fly.toml

@@ -1,41 +0,0 @@
-# Fly.io configuration for Gallus CMS Backend
-app = "gallus-cms-backend"
-primary_region = "ams"
-
-[build]
-  # Ensure Fly uses the Dockerfile in this backend directory
-  dockerfile = "Dockerfile"
-
-[env]
-  PORT = "8080"
-  NODE_ENV = "production"
-  GITEA_URL = "https://git.bookageek.ch"
-  DATABASE_PATH = "/app/data/gallus_cms.db"
-  GIT_WORKSPACE_DIR = "/app/data/workspace"
-  # Cross-site frontend and OAuth
-  FRONTEND_URL = "https://gallus-pub.ch"
-  CORS_ORIGIN = "https://gallus-pub.ch,https://www.gallus-pub.ch"
-  GITEA_REDIRECT_URI = "https://cms.gallus-pub.ch/api/auth/callback"
-
-[http_service]
-  internal_port = 8080
-  force_https = true
-  auto_stop_machines = "suspend"
-  auto_start_machines = true
-  min_machines_running = 0
-  processes = ["app"]
-
-  [[http_service.checks]]
-    grace_period = "10s"
-    interval = "30s"
-    method = "GET"
-    timeout = "5s"
-    path = "/health"
-
-[[vm]]
-  size = "shared-cpu-1x"
-  memory = "512mb"
-
-[mounts]
-  source = "gallus_data"
-  destination = "/app/data"

backend/migrate-production.js

@@ -1,183 +0,0 @@
-// Production migration script - can be run directly with node
-import Database from 'better-sqlite3';
-import { drizzle } from 'drizzle-orm/better-sqlite3';
-import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
-import { sql } from 'drizzle-orm';
-import fs from 'fs';
-import path from 'path';
-import sharp from 'sharp';
-
-// Database schema
-const events = sqliteTable('events', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  title: text('title').notNull(),
-  date: text('date').notNull(),
-  description: text('description').notNull(),
-  imageUrl: text('image_url').notNull(),
-  displayOrder: integer('display_order').notNull(),
-  isPublished: integer('is_published', { mode: 'boolean' }).default(true),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-const galleryImages = sqliteTable('gallery_images', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  imageUrl: text('image_url').notNull(),
-  altText: text('alt_text').notNull(),
-  displayOrder: integer('display_order').notNull(),
-  isPublished: integer('is_published', { mode: 'boolean' }).default(true),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Old events data
-const oldEvents = [
-  {
-    title: "Karaoke",
-    date: "2025-12-31",
-    description: `Bei uns gibt es Karaoke Mi-Sa!! <br>Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>`,
-    imageUrl: "/images/events/event_karaoke.webp",
-    displayOrder: 0,
-  },
-  {
-    title: "Pub Quiz",
-    date: "2025-12-31",
-    description: `Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>Auch Einzelpersonen sind herzlich willkommen! <br>*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF`,
-    displayOrder: 1,
-  },
-  {
-    title: "Schlager Hüttenzauber Karaoke",
-    date: "2025-11-27",
-    description: `Ab 19:00 Uhr Eintritt ist Frei! Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>`,
-    imageUrl: "/images/events/event_schlager-karaoke.webp",
-    displayOrder: 2,
-  },
-  {
-    title: "Adventskalender",
-    date: "2025-12-20",
-    description: `Jeden Tag neue Überraschungen! Check unsere Social Media Stories!`,
-    imageUrl: "/images/events/event_advents-kalender.webp",
-    displayOrder: 3,
-  },
-  {
-    title: "Santa Karaoke-Party",
-    date: "2025-12-06",
-    description: `🤶🏻🎅🏻Komme als Weihnachts-Mann/-Frau und bekomme einen Shot auf's Haus!🤶🏻🎅🏻`,
-    imageUrl: "/images/events/event_santa_karaoke.webp",
-    displayOrder: 4,
-  },
-  {
-    title: "Weihnachtsferien",
-    date: "2025-12-21",
-    description: `Wir sind ab 02.01.2026 wieder wie gewohnt für euch da! 🍀. <br> Für Anfragen WA <a href="tel:+41772322770">077 232 27 70</a> Antwort innerhalb 48h`,
-    imageUrl: "/images/events/event_ferien.webp",
-    displayOrder: 5,
-  },
-  {
-    title: "Neujahrs-Apero",
-    date: "2026-01-02",
-    description: `18:00-20:00 Uhr`,
-    imageUrl: "/images/events/event_neujahrs-apero.webp",
-    displayOrder: 6,
-  },
-];
-
-// Old gallery images
-const oldGalleryImages = [
-  { imageUrl: "/images/gallery/Gallery7.webp", alt: "Gallery 7", order: 0 },
-  { imageUrl: "/images/gallery/Gallery8.webp", alt: "Gallery 8", order: 1 },
-  { imageUrl: "/images/gallery/Gallery9.webp", alt: "Gallery 9", order: 2 },
-  { imageUrl: "/images/gallery/Gallery6.webp", alt: "Gallery 6", order: 3 },
-  { imageUrl: "/images/gallery/Gallery1.webp", alt: "Gallery 1", order: 4 },
-  { imageUrl: "/images/gallery/Gallery2.webp", alt: "Gallery 2", order: 5 },
-  { imageUrl: "/images/gallery/Gallery3.webp", alt: "Gallery 3", order: 6 },
-  { imageUrl: "/images/gallery/Gallery4.webp", alt: "Gallery 4", order: 7 },
-  { imageUrl: "/images/gallery/Gallery5.webp", alt: "Gallery 5", order: 8 },
-];
-
-async function main() {
-  console.log('=== Production Migration Script ===\n');
-
-  const dbPath = process.env.DATABASE_PATH || '/app/data/gallus_cms.db';
-  console.log('Database path:', dbPath);
-
-  // Check if database exists
-  if (!fs.existsSync(dbPath)) {
-    console.error('ERROR: Database not found at:', dbPath);
-    console.error('Please ensure the backend has been started at least once to create the database.');
-    process.exit(1);
-  }
-
-  // Check if images exist
-  const dataDir = process.env.GIT_WORKSPACE_DIR || '/app/data';
-  const eventsDir = path.join(dataDir, 'images', 'events');
-  const galleryDir = path.join(dataDir, 'images', 'gallery');
-
-  console.log('Events images directory:', eventsDir);
-  console.log('Gallery images directory:', galleryDir);
-
-  if (!fs.existsSync(eventsDir)) {
-    console.error('ERROR: Events images directory not found:', eventsDir);
-    process.exit(1);
-  }
-
-  if (!fs.existsSync(galleryDir)) {
-    console.error('ERROR: Gallery images directory not found:', galleryDir);
-    process.exit(1);
-  }
-
-  // List available images
-  console.log('\nAvailable event images:', fs.readdirSync(eventsDir));
-  console.log('Available gallery images:', fs.readdirSync(galleryDir));
-
-  // Connect to database
-  const sqlite = new Database(dbPath);
-  const db = drizzle(sqlite);
-
-  console.log('\n=== Migrating Events ===\n');
-
-  for (const event of oldEvents) {
-    try {
-      const [newEvent] = await db.insert(events).values({
-        title: event.title,
-        date: event.date,
-        description: event.description,
-        imageUrl: event.imageUrl,
-        displayOrder: event.displayOrder,
-        isPublished: true,
-      }).returning();
-
-      console.log(`✓ Migrated event: ${newEvent.title}`);
-    } catch (error) {
-      console.error(`✗ Failed to migrate event "${event.title}":`, error.message);
-    }
-  }
-
-  console.log('\n=== Migrating Gallery Images ===\n');
-
-  for (const img of oldGalleryImages) {
-    try {
-      const [newImage] = await db.insert(galleryImages).values({
-        imageUrl: img.imageUrl,
-        altText: img.alt,
-        displayOrder: img.order,
-        isPublished: true,
-      }).returning();
-
-      console.log(`✓ Migrated gallery image: ${newImage.altText}`);
-    } catch (error) {
-      console.error(`✗ Failed to migrate gallery image "${img.alt}":`, error.message);
-    }
-  }
-
-  sqlite.close();
-
-  console.log('\n✓ Migration completed successfully!');
-  console.log('\nYou can verify the migration by visiting:');
-  console.log('- Frontend: https://gallus-pub.ch/');
-  console.log('- Admin: https://gallus-pub.ch/admin');
-}
-
-main().catch(error => {
-  console.error('\n✗ Migration failed:', error);
-  process.exit(1);
-});

backend/package.json

@@ -1,37 +0,0 @@
-{
-  "name": "gallus-cms-backend",
-  "version": "1.0.0",
-  "type": "module",
-  "description": "Headless CMS backend for Gallus Pub website",
-  "scripts": {
-    "dev": "tsx watch src/index.ts",
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "db:studio": "drizzle-kit studio",
-    "migrate:old-data": "tsx src/scripts/migrate-old-data.ts"
-  },
-  "dependencies": {
-    "@fastify/cookie": "^9.3.1",
-    "@fastify/cors": "^9.0.1",
-    "@fastify/jwt": "^8.0.0",
-    "@fastify/static": "^6.12.0",
-    "@fastify/multipart": "^8.1.0",
-    "bcrypt": "^5.1.1",
-    "better-sqlite3": "^11.10.0",
-    "drizzle-orm": "^0.33.0",
-    "fastify": "^4.26.0",
-    "sharp": "^0.33.2",
-    "simple-git": "^3.22.0",
-    "zod": "^3.22.4"
-  },
-  "devDependencies": {
-    "@types/bcrypt": "^5.0.2",
-    "@types/better-sqlite3": "^7.6.9",
-    "@types/node": "^20.11.16",
-    "drizzle-kit": "^0.24.0",
-    "tsx": "^4.20.6",
-    "typescript": "^5.3.3"
-  }
-}

backend/src/config/database.ts

@@ -1,109 +0,0 @@
-import { drizzle } from 'drizzle-orm/better-sqlite3';
-import Database from 'better-sqlite3';
-import * as schema from '../db/schema.js';
-import { env } from './env.js';
-import fs from 'fs';
-import path from 'path';
-
-if (!env.DATABASE_PATH) {
-  throw new Error('DATABASE_PATH environment variable is not set');
-}
-
-// Ensure directory exists BEFORE opening the database file
-const dbDir = path.dirname(env.DATABASE_PATH);
-if (!fs.existsSync(dbDir)) {
-  fs.mkdirSync(dbDir, { recursive: true });
-}
-
-const sqlite = new Database(env.DATABASE_PATH);
-
-// Enable WAL mode for better concurrent access
-sqlite.pragma('journal_mode = WAL');
-
-export const db = drizzle(sqlite, { schema });
-
-// Auto-create tables if they don't exist
-export function initDatabase() {
-  console.log('🔧 Initializing database...');
-
-  try {
-    // Nur zur Protokollierung - angelegt wird immer, siehe unten
-    const tableCheck = sqlite
-      .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='users'")
-      .get();
-
-    console.log(tableCheck ? '📝 Checking database schema...' : '📝 Creating database schema...');
-
-    // Laeuft bei JEDEM Start. Alle Anweisungen sind IF NOT EXISTS, und nur so
-    // bekommen bestehende Datenbanken spaeter ergaenzte Tabellen ueberhaupt.
-    {
-      sqlite.exec(`
-        PRAGMA foreign_keys = ON;
-
-        CREATE TABLE IF NOT EXISTS users (
-          id TEXT PRIMARY KEY,
-          gitea_id TEXT UNIQUE NOT NULL,
-          gitea_username TEXT NOT NULL,
-          gitea_email TEXT,
-          display_name TEXT,
-          avatar_url TEXT,
-          role TEXT DEFAULT 'admin',
-          created_at INTEGER DEFAULT (unixepoch()),
-          last_login INTEGER
-        );
-
-        CREATE TABLE IF NOT EXISTS events (
-          id TEXT PRIMARY KEY,
-          title TEXT NOT NULL,
-          date TEXT NOT NULL,
-          description TEXT NOT NULL,
-          image_url TEXT NOT NULL,
-          display_order INTEGER NOT NULL,
-          is_published INTEGER DEFAULT 1,
-          created_at INTEGER DEFAULT (unixepoch()),
-          updated_at INTEGER DEFAULT (unixepoch())
-        );
-
-        CREATE TABLE IF NOT EXISTS gallery_images (
-          id TEXT PRIMARY KEY,
-          image_url TEXT NOT NULL,
-          alt_text TEXT NOT NULL,
-          display_order INTEGER NOT NULL,
-          is_published INTEGER DEFAULT 1,
-          created_at INTEGER DEFAULT (unixepoch())
-        );
-
-        CREATE TABLE IF NOT EXISTS content_sections (
-          id TEXT PRIMARY KEY,
-          section_name TEXT UNIQUE NOT NULL,
-          content_json TEXT NOT NULL,
-          updated_at INTEGER DEFAULT (unixepoch())
-        );
-
-        CREATE TABLE IF NOT EXISTS site_settings (
-          key TEXT PRIMARY KEY,
-          value TEXT NOT NULL,
-          updated_at INTEGER DEFAULT (unixepoch())
-        );
-
-        CREATE TABLE IF NOT EXISTS managed_assets (
-          path TEXT PRIMARY KEY,
-          created_at INTEGER DEFAULT (unixepoch())
-        );
-
-        CREATE TABLE IF NOT EXISTS publish_history (
-          id TEXT PRIMARY KEY,
-          user_id TEXT REFERENCES users(id),
-          commit_hash TEXT,
-          commit_message TEXT,
-          published_at INTEGER DEFAULT (unixepoch())
-        );
-      `);
-
-      console.log('✅ Database schema is up to date.');
-    }
-  } catch (error) {
-    console.error('❌ Error initializing database:', error);
-    throw error;
-  }
-}

backend/src/config/env.ts

@@ -1,56 +0,0 @@
-// Environment configuration with validation
-export const env = {
-  // Database
-  DATABASE_PATH: process.env.DATABASE_PATH || './data/gallus_cms.db',
-
-  // Gitea OAuth
-  GITEA_URL: process.env.GITEA_URL || 'https://git.bookageek.ch',
-  GITEA_CLIENT_ID: process.env.GITEA_CLIENT_ID || '',
-  GITEA_CLIENT_SECRET: process.env.GITEA_CLIENT_SECRET || '',
-  GITEA_REDIRECT_URI: process.env.GITEA_REDIRECT_URI || 'http://localhost:3000/api/auth/callback',
-  GITEA_ALLOWED_USERS: process.env.GITEA_ALLOWED_USERS || '',
-
-  // Git Configuration
-  GIT_REPO_URL: process.env.GIT_REPO_URL || '',
-  GIT_TOKEN: process.env.GIT_TOKEN || '',
-  GIT_USER_NAME: process.env.GIT_USER_NAME || 'Gallus CMS',
-  GIT_USER_EMAIL: process.env.GIT_USER_EMAIL || '[email protected]',
-  GIT_WORKSPACE_DIR: process.env.GIT_WORKSPACE_DIR || '/tmp/gallus-repo',
-
-  // JWT & Session
-  JWT_SECRET: process.env.JWT_SECRET || '',
-  SESSION_SECRET: process.env.SESSION_SECRET || '',
-
-  // Server
-  PORT: parseInt(process.env.PORT || '3000', 10),
-  NODE_ENV: process.env.NODE_ENV || 'development',
-  CORS_ORIGIN: process.env.CORS_ORIGIN || 'http://localhost:5173',
-  FRONTEND_URL: process.env.FRONTEND_URL || 'http://localhost:5173',
-
-  // Upload
-  // Bilder werden ohnehin auf 1600px heruntergerechnet, die Grenze muss nur
-  // gross genug fuer ein unbearbeitetes Handyfoto sein.
-  MAX_FILE_SIZE: parseInt(process.env.MAX_FILE_SIZE || String(20 * 1024 * 1024), 10),
-  // PDFs werden unveraendert abgelegt. Eine Getraenkekarte mit Bildern liegt
-  // schnell bei 15-20 MB, deshalb ein eigener, groesserer Wert.
-  MAX_PDF_SIZE: parseInt(process.env.MAX_PDF_SIZE || String(40 * 1024 * 1024), 10),
-};
-
-// Validate required environment variables
-export function validateEnv() {
-  const required = [
-    'DATABASE_PATH',
-    'GITEA_CLIENT_ID',
-    'GITEA_CLIENT_SECRET',
-    'GIT_REPO_URL',
-    'GIT_TOKEN',
-    'JWT_SECRET',
-    'SESSION_SECRET',
-  ];
-
-  const missing = required.filter(key => !env[key as keyof typeof env]);
-
-  if (missing.length > 0) {
-    throw new Error(`Missing required environment variables: ${missing.join(', ')}`);
-  }
-}

backend/src/db/schema.ts

@@ -1,84 +0,0 @@
-import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
-import { sql } from 'drizzle-orm';
-
-export const users = sqliteTable('users', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  giteaId: text('gitea_id').notNull().unique(),
-  giteaUsername: text('gitea_username').notNull(),
-  giteaEmail: text('gitea_email'),
-  displayName: text('display_name'),
-  avatarUrl: text('avatar_url'),
-  role: text('role').default('admin'),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-  lastLogin: integer('last_login', { mode: 'timestamp' }),
-});
-
-// Events table
-export const events = sqliteTable('events', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  title: text('title').notNull(),
-  date: text('date').notNull(),
-  description: text('description').notNull(),
-  imageUrl: text('image_url').notNull(),
-  displayOrder: integer('display_order').notNull(),
-  isPublished: integer('is_published', { mode: 'boolean' }).default(true),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Gallery images table
-export const galleryImages = sqliteTable('gallery_images', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  imageUrl: text('image_url').notNull(),
-  altText: text('alt_text').notNull(),
-  displayOrder: integer('display_order').notNull(),
-  isPublished: integer('is_published', { mode: 'boolean' }).default(true),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Content sections table (for text-based sections)
-export const contentSections = sqliteTable('content_sections', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  sectionName: text('section_name').notNull().unique(),
-  contentJson: text('content_json', { mode: 'json' }).notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Site settings table (global config)
-export const siteSettings = sqliteTable('site_settings', {
-  key: text('key').primaryKey(),
-  value: text('value').notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Publish history (audit log)
-export const publishHistory = sqliteTable('publish_history', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  userId: text('user_id').references(() => users.id),
-  commitHash: text('commit_hash'),
-  commitMessage: text('commit_message'),
-  publishedAt: integer('published_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Vom CMS selbst angelegte Dateien.
-//
-// Frueher wurde am Dateinamen erkannt, ob das CMS eine Datei loeschen darf.
-// Seit die Namen aus Alt-Text bzw. Original-Dateiname abgeleitet werden,
-// traegt der Name diese Information nicht mehr - ein hochgeladenes
-// karaoke-abend.avif sieht aus wie ein handgepflegtes event_karaoke.jpg.
-// Deshalb wird der Besitz hier festgehalten.
-export const managedAssets = sqliteTable('managed_assets', {
-  path: text('path').primaryKey(), // z.B. /images/events/karaoke-abend.avif
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});
-
-// Banner table (for announcements like holidays, special info)
-export const banners = sqliteTable('banners', {
-  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
-  text: text('text').notNull(),
-  startDate: text('start_date').notNull(), // ISO date string
-  endDate: text('end_date').notNull(), // ISO date string
-  isActive: integer('is_active', { mode: 'boolean' }).default(true),
-  createdAt: integer('created_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).default(sql`(unixepoch())`),
-});

backend/src/index.ts

@@ -1,170 +0,0 @@
-import Fastify from 'fastify';
-import cors from '@fastify/cors';
-import jwt from '@fastify/jwt';
-import multipart from '@fastify/multipart';
-import cookie from '@fastify/cookie';
-import { authenticate } from './middleware/auth.middleware.js';
-import { env, validateEnv } from './config/env.js';
-import { db, initDatabase } from './config/database.js';
-import fastifyStatic from '@fastify/static';
-import path from 'path';
-import fs from 'fs';
-
-// Import routes
-import authRoute from './routes/auth.js';
-import eventsRoute from './routes/events.js';
-import galleryRoute from './routes/gallery.js';
-import contentRoute from './routes/content.js';
-import settingsRoute from './routes/settings.js';
-import publishRoute from './routes/publish.js';
-import bannersRoute from './routes/banners.js';
-import pdfRoute from './routes/pdf.js';
-
-// Validate environment variables
-try {
-  validateEnv();
-} catch (error) {
-  console.error('Environment validation failed:', error);
-  process.exit(1);
-}
-
-const fastify = Fastify({
-  logger: {
-    level: env.NODE_ENV === 'production' ? 'info' : 'debug',
-    transport: env.NODE_ENV === 'development' ? {
-      target: 'pino-pretty',
-      options: {
-        translateTime: 'HH:MM:ss Z',
-        ignore: 'pid,hostname',
-      },
-    } : undefined,
-  },
-});
-
-// Register plugins
-// Support multiple origins for CORS
-const allowedOrigins = env.CORS_ORIGIN.split(',').map(o => o.trim());
-fastify.register(cors, {
-  origin: (origin, cb) => {
-    // Allow requests with no origin (like mobile apps or curl)
-    if (!origin) {
-      return cb(null, true);
-    }
-
-    // Check if origin is in allowed list
-    const isAllowed = allowedOrigins.includes(origin);
-
-    if (isAllowed) {
-      return cb(null, true);
-    } else {
-      return cb(null, false);
-    }
-  },
-  credentials: true,
-});
-
-fastify.register(cookie);
-
-fastify.register(jwt, {
-  secret: env.JWT_SECRET,
-  cookie: {
-    cookieName: 'token',
-    signed: false,
-  },
-});
-
-// Der globale Wert ist die Obergrenze fuer alles. Die Routen setzen ihn per
-// request.file({ limits }) auf ihren eigenen, engeren Wert herunter.
-fastify.register(multipart, {
-  limits: {
-    fileSize: Math.max(env.MAX_FILE_SIZE, env.MAX_PDF_SIZE),
-  },
-});
-
-// Serve static files (uploaded images, etc.) from persistent volume
-const dataDir = env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
-// Muss existieren, sonst verweigert @fastify/static die Registrierung
-fs.mkdirSync(dataDir, { recursive: true });
-fastify.register(fastifyStatic, {
-  root: dataDir,
-  prefix: '/static/',
-  decorateReply: false
-});
-
-// Uploads liegen unter <workspace>/public/images. In der DB stehen sie als
-// /images/... - das ist die URL auf der publizierten Astro-Seite. Damit die
-// Admin-Oberflaeche dieselben Pfade verwenden kann, hier ebenso ausliefern.
-const imagesDir = path.join(dataDir, 'public', 'images');
-fs.mkdirSync(imagesDir, { recursive: true });
-fastify.register(fastifyStatic, {
-  root: imagesDir,
-  prefix: '/images/',
-  decorateReply: false
-});
-
-// Dasselbe fuer die hochgeladenen PDFs (Getraenkekarte)
-const pdfDir = path.join(dataDir, 'public', 'pdf');
-fs.mkdirSync(pdfDir, { recursive: true });
-fastify.register(fastifyStatic, {
-  root: pdfDir,
-  prefix: '/pdf/',
-  decorateReply: false
-});
-
-// Decorate fastify with authenticate method
-fastify.decorate('authenticate', authenticate);
-
-// Register routes
-fastify.register(authRoute, { prefix: '/api' });
-fastify.register(eventsRoute, { prefix: '/api' });
-fastify.register(galleryRoute, { prefix: '/api' });
-fastify.register(contentRoute, { prefix: '/api' });
-fastify.register(settingsRoute, { prefix: '/api' });
-fastify.register(publishRoute, { prefix: '/api' });
-fastify.register(bannersRoute, { prefix: '/api' });
-fastify.register(pdfRoute, { prefix: '/api' });
-
-// Health check
-fastify.get('/health', async () => {
-  return {
-    status: 'ok',
-    timestamp: new Date().toISOString(),
-    environment: env.NODE_ENV,
-  };
-});
-
-// Root endpoint
-fastify.get('/', async () => {
-  return {
-    name: 'Gallus Pub CMS Backend',
-    version: '1.0.0',
-    status: 'running',
-  };
-});
-
-// Error handler
-fastify.setErrorHandler((error, request, reply) => {
-  fastify.log.error(error);
-
-  reply.status(error.statusCode || 500).send({
-    error: error.message || 'Internal Server Error',
-    statusCode: error.statusCode || 500,
-  });
-});
-
-// Start server
-const start = async () => {
-  try {
-    // Initialize database before starting server
-    initDatabase();
-    await fastify.listen({ port: env.PORT, host: '0.0.0.0' });
-    console.log(`🚀 Server listening on port ${env.PORT}`);
-    console.log(`📝 Environment: ${env.NODE_ENV}`);
-    console.log(`🔐 CORS Origin: ${env.CORS_ORIGIN}`);
-  } catch (err) {
-    fastify.log.error(err);
-    process.exit(1);
-  }
-};
-
-start();

backend/src/middleware/auth.middleware.ts

@@ -1,12 +0,0 @@
-import { FastifyRequest, FastifyReply } from 'fastify';
-
-export async function authenticate(
-  request: FastifyRequest,
-  reply: FastifyReply
-) {
-  try {
-    await request.jwtVerify();
-  } catch (err) {
-    reply.code(401).send({ error: 'Unauthorized' });
-  }
-}

backend/src/routes/auth.ts

@@ -1,187 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-import { db } from '../config/database.js';
-import { users } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-import { GiteaService } from '../services/gitea.service.js';
-import { env } from '../config/env.js';
-
-const callbackQueryJsonSchema = {
-  type: 'object',
-  required: ['code', 'state'],
-  properties: {
-    code: { type: 'string' },
-    state: { type: 'string' },
-  },
-} as const;
-
-const authRoute: FastifyPluginAsync = async (fastify) => {
-  const giteaService = new GiteaService();
-
-  /**
-   * GET /auth/gitea
-   * Initiate OAuth flow
-   */
-  fastify.get('/auth/gitea', async (request, reply) => {
-    // Generate CSRF state token
-    const state = giteaService.generateState();
-
-    // Store state in a short-lived cookie
-    reply.setCookie('oauth_state', state, {
-      path: '/',
-      httpOnly: true,
-      sameSite: 'none',
-      secure: true,
-      maxAge: 10 * 60, // 10 minutes
-    });
-
-    // Generate authorization URL
-    const authUrl = giteaService.getAuthorizationUrl(state);
-
-    // Redirect to Gitea
-    return reply.redirect(authUrl);
-  });
-
-  /**
-   * GET /auth/callback
-   * OAuth callback endpoint
-   */
-  fastify.get('/auth/callback', {
-    schema: {
-      querystring: callbackQueryJsonSchema,
-    },
-  }, async (request, reply) => {
-    try {
-      const { code, state } = request.query as { code: string; state: string };
-
-      // Verify CSRF state from cookie
-      const expectedState = request.cookies?.oauth_state as string | undefined;
-      if (!expectedState || state !== expectedState) {
-          return reply.code(400).send({ error: 'Invalid state parameter' });
-      }
-
-      // Clear state cookie
-      reply.clearCookie('oauth_state', { path: '/' });
-
-      // Exchange code for access token
-      const tokenResponse = await giteaService.exchangeCodeForToken(code);
-
-      // Fetch user info from Gitea
-      const giteaUser = await giteaService.getUserInfo(tokenResponse.access_token);
-
-      // Check if user is allowed
-      if (!giteaService.isUserAllowed(giteaUser.login)) {
-        return reply.code(403).send({
-          error: 'Access denied. You are not authorized to access this CMS.'
-        });
-      }
-
-      // Find or create user in database
-      let [user] = await db
-        .select()
-        .from(users)
-        .where(eq(users.giteaId, giteaUser.id.toString()))
-        .limit(1);
-
-      if (!user) {
-        // Create new user
-        [user] = await db.insert(users).values({
-          giteaId: giteaUser.id.toString(),
-          giteaUsername: giteaUser.login,
-          giteaEmail: giteaUser.email,
-          displayName: giteaUser.full_name,
-          avatarUrl: giteaUser.avatar_url,
-          lastLogin: new Date(),
-        }).returning();
-      } else {
-        // Update existing user
-        [user] = await db
-          .update(users)
-          .set({
-            giteaUsername: giteaUser.login,
-            giteaEmail: giteaUser.email,
-            displayName: giteaUser.full_name,
-            avatarUrl: giteaUser.avatar_url,
-            lastLogin: new Date(),
-          })
-          .where(eq(users.id, user.id))
-          .returning();
-      }
-
-      // Generate JWT for session management
-      const token = fastify.jwt.sign(
-        {
-          id: user.id,
-          giteaId: user.giteaId,
-          username: user.giteaUsername || '',
-          role: user.role ?? 'admin',
-        },
-        { expiresIn: '24h' }
-      );
-
-      // Also set token as HttpOnly cookie so subsequent API calls authenticate reliably
-      // Cross-site admin (gallus-pub.ch) -> backend (cms.gallus-pub.ch) requires SameSite=None & Secure in production
-      reply.setCookie('token', token, {
-        path: '/',
-        httpOnly: true,
-        sameSite: (env.NODE_ENV === 'production' ? 'none' : 'lax'),
-        secure: (env.NODE_ENV === 'production') || (!!env.FRONTEND_URL && env.FRONTEND_URL.startsWith('https')),
-        maxAge: 60 * 60 * 24, // 24h
-      });
-
-      // Redirect to admin dashboard
-      const frontendUrl = env.FRONTEND_URL;
-      return reply.redirect(`${frontendUrl}/admin`);
-
-    } catch (error) {
-      fastify.log.error({ err: error }, 'OAuth callback error');
-      return reply.code(500).send({ error: 'Authentication failed' });
-    }
-  });
-
-  /**
-   * GET /auth/me
-   * Get current user info
-   */
-  fastify.get('/auth/me', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const userId = request.user.id;
-
-    const [user] = await db
-      .select()
-      .from(users)
-      .where(eq(users.id, userId))
-      .limit(1);
-
-    if (!user) {
-      return reply.code(404).send({ error: 'User not found' });
-    }
-
-    return {
-      user: {
-        id: user.id,
-        giteaUsername: user.giteaUsername,
-        giteaEmail: user.giteaEmail,
-        displayName: user.displayName,
-        avatarUrl: user.avatarUrl,
-        role: user.role,
-      },
-    };
-  });
-
-  /**
-   * POST /auth/logout
-   * Logout (client-side token deletion)
-   */
-  fastify.post('/auth/logout', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    // For JWT, logout is primarily client-side (delete token)
-    // You could maintain a token blacklist in Redis for production
-    reply.clearCookie('token', { path: '/' });
-    return { message: 'Logged out successfully' };
-  });
-};
-
-export default authRoute;

backend/src/routes/banners.ts

@@ -1,152 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { db } from '../config/database.js';
-import { banners } from '../db/schema.js';
-import { eq, and, lte, gte, desc } from 'drizzle-orm';
-
-const bannerBodyJsonSchema = {
-  type: 'object',
-  required: ['text', 'startDate', 'endDate'],
-  properties: {
-    text: { type: 'string' },
-    startDate: { type: 'string' },
-    endDate: { type: 'string' },
-    isActive: { type: 'boolean' },
-  },
-} as const;
-
-const bannersRoute: FastifyPluginAsync = async (fastify) => {
-
-  // Get active banner (public endpoint)
-  fastify.get('/banners/active', async (request, reply) => {
-    // Use local date to avoid timezone issues
-    const now = new Date();
-    const today = new Date(now.getTime() - (now.getTimezoneOffset() * 60000))
-      .toISOString()
-      .split('T')[0]; // YYYY-MM-DD
-
-    const [activeBanner] = await db
-      .select()
-      .from(banners)
-      .where(
-        and(
-          eq(banners.isActive, true),
-          lte(banners.startDate, today),
-          gte(banners.endDate, today)
-        )
-      )
-      .orderBy(desc(banners.createdAt))
-      .limit(1);
-
-    if (!activeBanner) {
-      return { banner: null };
-    }
-
-    return {
-      banner: {
-        id: activeBanner.id,
-        text: activeBanner.text,
-        startDate: activeBanner.startDate,
-        endDate: activeBanner.endDate,
-      },
-    };
-  });
-
-  // Get all banners (admin only)
-  fastify.get('/banners', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const allBanners = await db.select().from(banners);
-
-    return {
-      banners: allBanners.map((b: any) => ({
-        id: b.id,
-        text: b.text,
-        startDate: b.startDate,
-        endDate: b.endDate,
-        isActive: b.isActive,
-        createdAt: b.createdAt,
-        updatedAt: b.updatedAt,
-      })),
-    };
-  });
-
-  // Create banner (admin only)
-  fastify.post('/banners', {
-    schema: {
-      body: bannerBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { text, startDate, endDate, isActive = true } = request.body as any;
-
-    const [newBanner] = await db
-      .insert(banners)
-      .values({
-        text,
-        startDate,
-        endDate,
-        isActive,
-      })
-      .returning();
-
-    return {
-      banner: {
-        id: newBanner.id,
-        text: newBanner.text,
-        startDate: newBanner.startDate,
-        endDate: newBanner.endDate,
-        isActive: newBanner.isActive,
-      },
-    };
-  });
-
-  // Update banner (admin only)
-  fastify.put('/banners/:id', {
-    schema: {
-      body: bannerBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const { text, startDate, endDate, isActive } = request.body as any;
-
-    const [updated] = await db
-      .update(banners)
-      .set({
-        text,
-        startDate,
-        endDate,
-        isActive,
-        updatedAt: new Date(),
-      })
-      .where(eq(banners.id, id))
-      .returning();
-
-    if (!updated) {
-      return reply.code(404).send({ error: 'Banner not found' });
-    }
-
-    return {
-      banner: {
-        id: updated.id,
-        text: updated.text,
-        startDate: updated.startDate,
-        endDate: updated.endDate,
-        isActive: updated.isActive,
-      },
-    };
-  });
-
-  // Delete banner (admin only)
-  fastify.delete('/banners/:id', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-
-    await db.delete(banners).where(eq(banners.id, id));
-
-    return { success: true };
-  });
-};
-
-export default bannersRoute;

backend/src/routes/content.ts

@@ -1,154 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-import { db } from '../config/database.js';
-import { contentSections } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-import { saveUploadedImage } from '../services/upload.service.js';
-import { dropImageIfUnused, extractImageUrls } from '../services/image-refs.service.js';
-import { env } from '../config/env.js';
-
-// Fastify JSON schema for content section body
-const contentBodyJsonSchema = {
-  type: 'object',
-  required: ['contentJson'],
-  properties: {
-    contentJson: {}, // allow any JSON
-  },
-} as const;
-
-const contentRoute: FastifyPluginAsync = async (fastify) => {
-
-  // Get content section
-  fastify.get('/content/:section', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { section } = request.params as { section: string };
-
-    const [content] = await db
-      .select()
-      .from(contentSections)
-      .where(eq(contentSections.sectionName, section))
-      .limit(1);
-
-    if (!content) {
-      return reply.code(404).send({ error: 'Content section not found' });
-    }
-
-    return {
-      section: content.sectionName,
-      content: content.contentJson,
-      updatedAt: content.updatedAt,
-    };
-  });
-
-  // Update content section
-  fastify.put('/content/:section', {
-    schema: {
-      body: contentBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { section } = request.params as { section: string };
-    const { contentJson } = request.body as any;
-
-    // Check if section exists
-    const [existing] = await db
-      .select()
-      .from(contentSections)
-      .where(eq(contentSections.sectionName, section))
-      .limit(1);
-
-    let result;
-
-    if (existing) {
-      // Update existing
-      [result] = await db
-        .update(contentSections)
-        .set({
-          contentJson,
-          updatedAt: new Date(),
-        })
-        .where(eq(contentSections.sectionName, section))
-        .returning();
-    } else {
-      // Create new
-      [result] = await db
-        .insert(contentSections)
-        .values({
-          sectionName: section,
-          contentJson,
-        })
-        .returning();
-    }
-
-    // Bilder, die durch die Aenderung herausgefallen sind, wegraeumen
-    const before = extractImageUrls((existing as any)?.contentJson);
-    const after = extractImageUrls(result.contentJson);
-    for (const url of before) {
-      if (after.has(url)) continue;
-      try {
-        if (await dropImageIfUnused(url)) {
-          fastify.log.info(`Removed unused content image ${url}`);
-        }
-      } catch (err) {
-        fastify.log.warn({ err }, 'Could not remove unused content image');
-      }
-    }
-
-    return {
-      section: result.sectionName,
-      content: result.contentJson,
-      updatedAt: result.updatedAt,
-    };
-  });
-
-  // Bild fuer einen Textbereich hochladen (Welcome-Bild, Monatshit, Whiskey)
-  fastify.post('/content/upload', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    try {
-      const file = await (request as any).file({ limits: { fileSize: env.MAX_FILE_SIZE } });
-      if (!file) {
-        return reply.code(400).send({ error: 'No file uploaded' });
-      }
-
-      const mime = file.mimetype as string | undefined;
-      if (!mime || !mime.startsWith('image/')) {
-        return reply.code(400).send({ error: 'Only image uploads are allowed' });
-      }
-
-      const preferredName = (file.fields?.name?.value as string | undefined) || '';
-
-      const saved = await saveUploadedImage(file, 'content', {
-        preferredName,
-        log: fastify.log,
-      });
-
-      return reply.code(201).send({ imageUrl: saved.imageUrl });
-
-    } catch (err: any) {
-      if (err?.statusCode === 413) {
-        return reply.code(413).send({ error: err.message });
-      }
-      fastify.log.error({ err }, 'Upload failed');
-      return reply.code(500).send({ error: 'Failed to upload image' });
-    }
-  });
-
-  // List all content sections
-  fastify.get('/content', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const sections = await db.select().from(contentSections);
-
-    return {
-      sections: (sections as any[]).map((s: any) => ({
-        section: s.sectionName,
-        content: s.contentJson,
-        updatedAt: s.updatedAt,
-      })),
-    };
-  });
-};
-
-export default contentRoute;

backend/src/routes/events.ts

@@ -1,160 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { db } from '../config/database.js';
-import { events } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-import { dropImageIfUnused } from '../services/image-refs.service.js';
-import { saveUploadedImage } from '../services/upload.service.js';
-import { env } from '../config/env.js';
-
-/** Raeumt eine Bilddatei weg, ohne dass ein Fehler die Antwort kippt. */
-async function dropUnusedImage(fastify: any, url: string | null | undefined, reason: string) {
-  try {
-    if (await dropImageIfUnused(url)) {
-      fastify.log.info(`Removed ${reason} ${url}`);
-    }
-  } catch (err) {
-    fastify.log.warn({ err }, `Could not remove ${reason}`);
-  }
-}
-
-// Fastify JSON schema for event body
-const eventBodyJsonSchema = {
-  type: 'object',
-  required: ['title', 'date', 'description', 'imageUrl', 'displayOrder'],
-  properties: {
-    title: { type: 'string', minLength: 1, maxLength: 200 },
-    date: { type: 'string', minLength: 1, maxLength: 100 },
-    description: { type: 'string', minLength: 1 },
-    imageUrl: { type: 'string', minLength: 1 },
-    displayOrder: { type: 'integer', minimum: 0 },
-    isPublished: { type: 'boolean' },
-  },
-} as const;
-
-const reorderBodyJsonSchema = {
-  type: 'object',
-  required: ['orders'],
-  properties: {
-    orders: {
-      type: 'array',
-      items: {
-        type: 'object',
-        required: ['id', 'displayOrder'],
-        properties: {
-          id: { type: 'string' },
-          displayOrder: { type: 'integer', minimum: 0 },
-        },
-      },
-    },
-  },
-} as const;
-
-const eventsRoute: FastifyPluginAsync = async (fastify) => {
-  // PUBLIC: List published events (no auth required)
-  fastify.get('/events/public', async () => {
-    const all = await db.select().from(events)
-      .where(eq(events.isPublished, true))
-      .orderBy(events.displayOrder);
-    return { events: all };
-  });
-
-  // List all events (by displayOrder) - admin only
-  fastify.get('/events', { preHandler: [fastify.authenticate] }, async () => {
-    const all = await db.select().from(events).orderBy(events.displayOrder);
-    return { events: all };
-  });
-
-  // Get single event
-  fastify.get('/events/:id', { preHandler: [fastify.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const rows = await db.select().from(events).where(eq(events.id, id)).limit(1);
-    if (rows.length === 0) return reply.code(404).send({ error: 'Event not found' });
-    return { event: rows[0] };
-  });
-
-  // Create event
-  fastify.post('/events', { schema: { body: eventBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request, reply) => {
-    const data = request.body as any;
-    const [row] = await db.insert(events).values(data).returning();
-    return reply.code(201).send({ event: row });
-  });
-
-  // Update event
-  fastify.put('/events/:id', { schema: { body: eventBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const data = request.body as any;
-
-    const [previous] = await db.select().from(events).where(eq(events.id, id)).limit(1);
-
-    const [row] = await db.update(events).set({ ...data, updatedAt: new Date() }).where(eq(events.id, id)).returning();
-    if (!row) return reply.code(404).send({ error: 'Event not found' });
-
-    // Ausgetauschtes Bild wegraeumen, sonst bleibt es fuer immer liegen
-    if (previous && previous.imageUrl !== row.imageUrl) {
-      await dropUnusedImage(fastify, previous.imageUrl, 'replaced event image');
-    }
-
-    return { event: row };
-  });
-
-  // Upload event image file (multipart)
-  fastify.post('/events/upload', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    try {
-      // Expect a single file field named "file"
-      const file = await (request as any).file({ limits: { fileSize: env.MAX_FILE_SIZE } });
-      if (!file) {
-        return reply.code(400).send({ error: 'No file uploaded' });
-      }
-
-      const mime = file.mimetype as string | undefined;
-      if (!mime || !mime.startsWith('image/')) {
-        return reply.code(400).send({ error: 'Only image uploads are allowed' });
-      }
-
-      // Der Titel kommt als Formularfeld VOR der Datei, sonst ist er hier
-      // noch nicht geparst
-      const preferredName = (file.fields?.title?.value as string | undefined) || '';
-
-      const saved = await saveUploadedImage(file, 'events', {
-        preferredName,
-        log: fastify.log,
-      });
-
-      return reply.code(201).send({ imageUrl: saved.imageUrl });
-
-    } catch (err: any) {
-      if (err?.statusCode === 413) {
-        return reply.code(413).send({ error: err.message });
-      }
-      fastify.log.error({ err }, 'Upload failed');
-      return reply.code(500).send({ error: 'Failed to upload image' });
-    }
-  });
-
-  // Delete event
-  fastify.delete('/events/:id', { preHandler: [fastify.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const [row] = await db.delete(events).where(eq(events.id, id)).returning();
-    if (!row) return reply.code(404).send({ error: 'Event not found' });
-
-    // Zugehoerige Bilddatei mitnehmen
-    await dropUnusedImage(fastify, row.imageUrl, 'event image');
-
-    return { message: 'Event deleted successfully' };
-  });
-
-  // Reorder events (synchronous transaction for better-sqlite3)
-  fastify.put('/events/reorder', { schema: { body: reorderBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request) => {
-    const { orders } = request.body as { orders: Array<{ id: string; displayOrder: number }> };
-    db.transaction((tx: any) => {
-      for (const { id, displayOrder } of orders) {
-        tx.update(events).set({ displayOrder }).where(eq(events.id, id)).run?.();
-      }
-    });
-    return { message: 'Events reordered successfully' };
-  });
-};
-
-export default eventsRoute;

backend/src/routes/gallery.ts

@@ -1,210 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-import { db } from '../config/database.js';
-import { galleryImages } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-import { dropImageIfUnused } from '../services/image-refs.service.js';
-import { saveUploadedImage } from '../services/upload.service.js';
-import { env } from '../config/env.js';
-
-/** Raeumt eine Bilddatei weg, ohne dass ein Fehler die Antwort kippt. */
-async function dropUnusedImage(fastify: any, url: string | null | undefined, reason: string) {
-  try {
-    if (await dropImageIfUnused(url)) {
-      fastify.log.info(`Removed ${reason} ${url}`);
-    }
-  } catch (err) {
-    fastify.log.warn({ err }, `Could not remove ${reason}`);
-  }
-}
-
-// Fastify JSON schema for gallery image body
-const galleryBodyJsonSchema = {
-  type: 'object',
-  required: ['imageUrl', 'altText', 'displayOrder'],
-  properties: {
-    imageUrl: { type: 'string', minLength: 1 },
-    altText: { type: 'string', minLength: 1, maxLength: 200 },
-    displayOrder: { type: 'integer', minimum: 0 },
-    isPublished: { type: 'boolean' },
-  },
-} as const;
-
-const galleryRoute: FastifyPluginAsync = async (fastify) => {
-
-  // PUBLIC: List published gallery images (no auth required)
-  fastify.get('/gallery/public', async () => {
-    const images = await db.select().from(galleryImages)
-      .where(eq(galleryImages.isPublished, true))
-      .orderBy(galleryImages.displayOrder);
-    return { images };
-  });
-
-  // List all gallery images - admin only
-  fastify.get('/gallery', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const images = await db.select().from(galleryImages).orderBy(galleryImages.displayOrder);
-    return { images };
-  });
-
-  // Get single gallery image
-  fastify.get('/gallery/:id', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const image = await db.select().from(galleryImages).where(eq(galleryImages.id, id)).limit(1);
-
-    if (image.length === 0) {
-      return reply.code(404).send({ error: 'Image not found' });
-    }
-
-    return { image: image[0] };
-  });
-
-  // Create gallery image
-  fastify.post('/gallery', {
-    schema: {
-      body: galleryBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const data = request.body as any;
-
-    const [newImage] = await db.insert(galleryImages).values(data).returning();
-
-    return reply.code(201).send({ image: newImage });
-  });
-
-  // Upload image file (multipart)
-  fastify.post('/gallery/upload', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    try {
-      // Expect a single file field named "file"
-      const file = await (request as any).file({ limits: { fileSize: env.MAX_FILE_SIZE } });
-      if (!file) {
-        return reply.code(400).send({ error: 'No file uploaded' });
-      }
-
-      const altText = (file.fields?.altText?.value as string | undefined) || '';
-      const displayOrderRaw = (file.fields?.displayOrder?.value as string | undefined) || '0';
-      const displayOrder = Number.parseInt(displayOrderRaw) || 0;
-
-      const mime = file.mimetype as string | undefined;
-      if (!mime || !mime.startsWith('image/')) {
-        return reply.code(400).send({ error: 'Only image uploads are allowed' });
-      }
-
-      const saved = await saveUploadedImage(file, 'gallery', {
-        preferredName: altText,
-        log: fastify.log,
-      });
-
-      // Store in DB (optional but useful)
-      const [row] = await db.insert(galleryImages).values({
-        imageUrl: saved.imageUrl,
-        altText: altText || saved.filename,
-        displayOrder,
-        isPublished: true,
-      }).returning();
-
-      return reply.code(201).send({ image: row });
-
-    } catch (err: any) {
-      if (err?.statusCode === 413) {
-        return reply.code(413).send({ error: err.message });
-      }
-      fastify.log.error({ err }, 'Upload failed');
-      return reply.code(500).send({ error: 'Failed to upload image' });
-    }
-  });
-
-  // Update gallery image
-  fastify.put('/gallery/:id', {
-    schema: {
-      body: galleryBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const data = request.body as any;
-
-    const [previous] = await db.select().from(galleryImages).where(eq(galleryImages.id, id)).limit(1);
-
-    const [updated] = await db
-      .update(galleryImages)
-      .set(data)
-      .where(eq(galleryImages.id, id))
-      .returning();
-
-    if (!updated) {
-      return reply.code(404).send({ error: 'Image not found' });
-    }
-
-    // Ausgetauschte Datei wegraeumen
-    if (previous && previous.imageUrl !== updated.imageUrl) {
-      await dropUnusedImage(fastify, previous.imageUrl, 'replaced gallery image');
-    }
-
-    return { image: updated };
-  });
-
-  // Delete gallery image
-  fastify.delete('/gallery/:id', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-
-    const [deleted] = await db
-      .delete(galleryImages)
-      .where(eq(galleryImages.id, id))
-      .returning();
-
-    if (!deleted) {
-      return reply.code(404).send({ error: 'Image not found' });
-    }
-
-    // Zugehoerige Bilddatei mitnehmen
-    await dropUnusedImage(fastify, deleted.imageUrl, 'gallery image');
-
-    return { message: 'Image deleted successfully' };
-  });
-
-  // Reorder gallery images
-  fastify.put('/gallery/reorder', {
-    schema: {
-      body: {
-        type: 'object',
-        required: ['orders'],
-        properties: {
-          orders: {
-            type: 'array',
-            items: {
-              type: 'object',
-              required: ['id', 'displayOrder'],
-              properties: {
-                id: { type: 'string' },
-                displayOrder: { type: 'integer', minimum: 0 },
-              },
-            },
-          },
-        },
-      },
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { orders } = request.body as { orders: Array<{ id: string; displayOrder: number }> };
-
-    // Update all in synchronous transaction (better-sqlite3 requirement)
-    db.transaction((tx: any) => {
-      for (const { id, displayOrder } of orders) {
-        tx.update(galleryImages).set({ displayOrder }).where(eq(galleryImages.id, id)).run?.();
-      }
-    });
-
-    return { message: 'Gallery images reordered successfully' };
-  });
-};
-
-export default galleryRoute;

backend/src/routes/pdf.ts

@@ -1,125 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { eq } from 'drizzle-orm';
-import { db } from '../config/database.js';
-import { contentSections } from '../db/schema.js';
-import { AssetService } from '../services/asset.service.js';
-import { isManagedAsset, forgetManagedAsset } from '../services/managed-assets.service.js';
-import { saveUploadedPdf } from '../services/upload.service.js';
-import { env } from '../config/env.js';
-
-const assets = new AssetService();
-
-/**
- * Feste PDF-Plaetze. Die URL landet jeweils in einer Content-Section, damit
- * der Generator sie beim Publish in die Astro-Komponente schreiben kann.
- */
-const PDF_SLOTS: Record<string, { section: string; field: string }> = {
-  drinks: { section: 'drinks', field: 'pdfUrl' },
-};
-
-/** contentJson kommt je nach Treiber als Objekt oder als String zurueck. */
-function asObject(value: any): Record<string, any> {
-  if (!value) return {};
-  if (typeof value === 'string') {
-    try {
-      const parsed = JSON.parse(value);
-      return parsed && typeof parsed === 'object' ? parsed : {};
-    } catch {
-      return {};
-    }
-  }
-  return typeof value === 'object' ? value : {};
-}
-
-const pdfRoute: FastifyPluginAsync = async (fastify) => {
-
-  // PDF fuer einen festen Platz hochladen und verlinken
-  fastify.post('/pdf/:slot', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { slot } = request.params as { slot: string };
-    const target = PDF_SLOTS[slot];
-
-    if (!target) {
-      return reply.code(404).send({ error: `Unknown PDF slot "${slot}"` });
-    }
-
-    try {
-      const file = await (request as any).file({ limits: { fileSize: env.MAX_PDF_SIZE } });
-      if (!file) {
-        return reply.code(400).send({ error: 'No file uploaded' });
-      }
-
-      const mime = file.mimetype as string | undefined;
-      const originalName = (file.filename as string | undefined) || '';
-      if (mime !== 'application/pdf' && !originalName.toLowerCase().endsWith('.pdf')) {
-        return reply.code(400).send({ error: 'Only PDF uploads are allowed' });
-      }
-
-      const chunks: Buffer[] = [];
-      for await (const chunk of file.file) {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-      }
-      const buffer = Buffer.concat(chunks);
-
-      if ((file.file as any)?.truncated) {
-        const limit = Math.round(env.MAX_PDF_SIZE / 1024 / 1024);
-        return reply.code(413).send({ error: `PDF too large. Maximum is ${limit} MB` });
-      }
-
-      // Inhalt gegenpruefen, damit nicht irgendetwas mit .pdf-Endung landet
-      if (buffer.subarray(0, 5).toString('latin1') !== '%PDF-') {
-        return reply.code(400).send({ error: 'File is not a valid PDF' });
-      }
-
-      const pdfUrl = await saveUploadedPdf(file, buffer);
-
-      // URL in der Content-Section hinterlegen
-      const [existing] = await db
-        .select()
-        .from(contentSections)
-        .where(eq(contentSections.sectionName, target.section))
-        .limit(1);
-
-      const previousContent = asObject((existing as any)?.contentJson);
-      const previousUrl = previousContent[target.field];
-      const content = { ...previousContent, [target.field]: pdfUrl };
-
-      if (existing) {
-        await db
-          .update(contentSections)
-          .set({ contentJson: content, updatedAt: new Date() })
-          .where(eq(contentSections.sectionName, target.section));
-      } else {
-        await db
-          .insert(contentSections)
-          .values({ sectionName: target.section, contentJson: content });
-      }
-
-      // Vorgaenger wegraeumen - greift nur bei frueher hochgeladenen PDFs,
-      // die mitgelieferte Getraenkekarte aus dem Repo bleibt liegen
-      if (previousUrl && previousUrl !== pdfUrl && (await isManagedAsset(previousUrl))) {
-        try {
-          if (assets.deletePdf(previousUrl)) {
-            fastify.log.info(`Removed replaced PDF ${previousUrl}`);
-          }
-          await forgetManagedAsset(previousUrl);
-        } catch (err) {
-          fastify.log.warn({ err }, 'Could not remove replaced PDF');
-        }
-      }
-
-      return reply.code(201).send({ pdfUrl, section: target.section });
-
-    } catch (err: any) {
-      if (err?.code === 'FST_REQ_FILE_TOO_LARGE') {
-        const limit = Math.round(env.MAX_PDF_SIZE / 1024 / 1024);
-        return reply.code(413).send({ error: `PDF too large. Maximum is ${limit} MB` });
-      }
-      fastify.log.error({ err }, 'PDF upload failed');
-      return reply.code(500).send({ error: 'Failed to upload PDF' });
-    }
-  });
-};
-
-export default pdfRoute;

backend/src/routes/publish.ts

@@ -1,142 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-import { GitService } from '../services/git.service.js';
-import { FileGeneratorService } from '../services/file-generator.service.js';
-import { sweepOrphanedImages } from '../services/image-refs.service.js';
-import { db } from '../config/database.js';
-import { events, galleryImages, contentSections, publishHistory } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-
-// Fastify JSON schema for publish body
-const publishBodyJsonSchema = {
-  type: 'object',
-  required: ['commitMessage'],
-  properties: {
-    commitMessage: { type: 'string', minLength: 1, maxLength: 200 },
-  },
-} as const;
-
-const publishRoute: FastifyPluginAsync = async (fastify) => {
-  fastify.post('/publish', {
-    schema: {
-      body: publishBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    try {
-      const { commitMessage } = request.body as any;
-      const userId = request.user.id;
-
-      fastify.log.info('Starting publish process...');
-
-      // Initialize git service
-      const gitService = new GitService();
-      await gitService.initialize();
-
-      fastify.log.info('Git repository initialized');
-
-      // Verwaiste Uploads entfernen, bevor committet wird
-      const removedImages = await sweepOrphanedImages();
-
-      if (removedImages.length > 0) {
-        fastify.log.info(`Removed ${removedImages.length} orphaned image(s): ${removedImages.join(', ')}`);
-      }
-
-      // Fetch all content from database
-      const eventsData = await db
-        .select()
-        .from(events)
-        .where(eq(events.isPublished, true))
-        .orderBy(events.displayOrder);
-
-      const galleryData = await db
-        .select()
-        .from(galleryImages)
-        .where(eq(galleryImages.isPublished, true))
-        .orderBy(galleryImages.displayOrder);
-
-      const sectionsData = await db.select().from(contentSections);
-      const sectionsMap = new Map<string, any>(
-        (sectionsData as any[]).map((s: any) => [s.sectionName as string, s.contentJson as any])
-      );
-
-      fastify.log.info(`Fetched ${eventsData.length} events, ${galleryData.length} images, ${sectionsData.length} sections`);
-
-      // Generate and write files
-      const fileGenerator = new FileGeneratorService();
-      await fileGenerator.writeFiles(
-        gitService.getWorkspacePath(''),
-        (eventsData as any[]).map((e: any) => ({
-          title: e.title,
-          date: e.date,
-          description: e.description,
-          imageUrl: e.imageUrl,
-        })),
-        (galleryData as any[]).map((g: any) => ({
-          imageUrl: g.imageUrl,
-          altText: g.altText,
-        })),
-        sectionsMap
-      );
-
-      fastify.log.info('Files generated successfully');
-
-      // Commit and push
-      const commitHash = await gitService.commitAndPush(commitMessage);
-
-      fastify.log.info(`Changes committed: ${commitHash}`);
-
-      // Record in history. Der Push ist an dieser Stelle bereits durch -
-      // ein Fehler im Protokoll darf die Veroeffentlichung nicht als
-      // gescheitert melden und den Workspace zuruecksetzen.
-      try {
-        await db.insert(publishHistory).values({
-          userId,
-          commitHash,
-          commitMessage,
-        });
-      } catch (historyError) {
-        fastify.log.warn({ err: historyError }, 'Could not record publish history');
-      }
-
-      return {
-        success: true,
-        commitHash,
-        removedImages: removedImages.length,
-        message: 'Changes published successfully',
-      };
-
-    } catch (error) {
-      fastify.log.error({ err: error }, 'Publish error');
-
-      // Attempt to reset git state on error
-      try {
-        const gitService = new GitService();
-        await gitService.reset();
-      } catch (resetError) {
-        fastify.log.error({ err: resetError }, 'Failed to reset git state');
-      }
-
-      return reply.code(500).send({
-        success: false,
-        error: 'Failed to publish changes',
-        details: error instanceof Error ? error.message : 'Unknown error',
-      });
-    }
-  });
-
-  // Get publish history
-  fastify.get('/publish/history', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const history = await db
-      .select()
-      .from(publishHistory)
-      .orderBy(publishHistory.publishedAt)
-      .limit(20);
-
-    return { history };
-  });
-};
-
-export default publishRoute;

backend/src/routes/settings.ts

@@ -1,121 +0,0 @@
-import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-import { db } from '../config/database.js';
-import { siteSettings } from '../db/schema.js';
-import { eq } from 'drizzle-orm';
-
-// Fastify JSON schema for settings body
-const settingBodyJsonSchema = {
-  type: 'object',
-  required: ['value'],
-  properties: {
-    value: { type: 'string' },
-  },
-} as const;
-
-const settingsRoute: FastifyPluginAsync = async (fastify) => {
-
-  // Get all settings
-  fastify.get('/settings', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const settings = await db.select().from(siteSettings);
-
-    return {
-      settings: settings.reduce((acc, setting) => {
-        acc[setting.key] = setting.value;
-        return acc;
-      }, {} as Record<string, string>),
-    };
-  });
-
-  // Get single setting
-  fastify.get('/settings/:key', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { key } = request.params as { key: string };
-
-    const [setting] = await db
-      .select()
-      .from(siteSettings)
-      .where(eq(siteSettings.key, key))
-      .limit(1);
-
-    if (!setting) {
-      return reply.code(404).send({ error: 'Setting not found' });
-    }
-
-    return {
-      key: setting.key,
-      value: setting.value,
-      updatedAt: setting.updatedAt,
-    };
-  });
-
-  // Update setting
-  fastify.put('/settings/:key', {
-    schema: {
-      body: settingBodyJsonSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { key } = request.params as { key: string };
-    const { value } = request.body as any;
-
-    // Check if setting exists
-    const [existing] = await db
-      .select()
-      .from(siteSettings)
-      .where(eq(siteSettings.key, key))
-      .limit(1);
-
-    let result;
-
-    if (existing) {
-      // Update existing
-      [result] = await db
-        .update(siteSettings)
-        .set({
-          value,
-          updatedAt: new Date(),
-        })
-        .where(eq(siteSettings.key, key))
-        .returning();
-    } else {
-      // Create new
-      [result] = await db
-        .insert(siteSettings)
-        .values({
-          key,
-          value,
-        })
-        .returning();
-    }
-
-    return {
-      key: result.key,
-      value: result.value,
-      updatedAt: result.updatedAt,
-    };
-  });
-
-  // Delete setting
-  fastify.delete('/settings/:key', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const { key } = request.params as { key: string };
-
-    const [deleted] = await db
-      .delete(siteSettings)
-      .where(eq(siteSettings.key, key))
-      .returning();
-
-    if (!deleted) {
-      return reply.code(404).send({ error: 'Setting not found' });
-    }
-
-    return { message: 'Setting deleted successfully' };
-  });
-};
-
-export default settingsRoute;

backend/src/scripts/convert-images-to-avif.ts

@@ -1,218 +0,0 @@
-/**
- * Einmalige Umwandlung des Altbestands nach AVIF.
- *
- * Bilder, die vor der Umstellung hochgeladen wurden, liegen unverkleinert
- * und im Originalformat im Repo - damals war sharp im Container kaputt, es
- * gab also weder Verkleinerung noch Formatwandlung. Dieses Skript schickt
- * sie durch dieselbe Verarbeitung wie einen frischen Upload, benennt sie
- * nach ihrem Inhalt und zieht die Verweise in der Datenbank mit.
- *
- * Aufruf im Container:
- *   node dist/scripts/convert-images-to-avif.js          # nur anzeigen
- *   node dist/scripts/convert-images-to-avif.js --apply  # wirklich tun
- *
- * Ohne --apply wird nichts geschrieben.
- */
-
-import fs from 'fs';
-import path from 'path';
-import { eq } from 'drizzle-orm';
-import { db, initDatabase } from '../config/database.js';
-import { events, galleryImages, contentSections } from '../db/schema.js';
-import { GitService } from '../services/git.service.js';
-import { AssetService, MANAGED_IMAGE_DIRS } from '../services/asset.service.js';
-import { saveImageBuffer, UploadSubdir } from '../services/upload.service.js';
-import { replaceImageUrls, dropImageIfUnused } from '../services/image-refs.service.js';
-import { env } from '../config/env.js';
-
-const APPLY = process.argv.includes('--apply');
-
-const assets = new AssetService();
-
-interface Candidate {
-  url: string;
-  preferredName: string;
-}
-
-/** /images/events/foo.jpg -> events */
-function subdirOf(url: string): UploadSubdir | null {
-  const match = /^\/images\/(events|gallery|content)\//.exec(url);
-  return match ? (match[1] as UploadSubdir) : null;
-}
-
-function absolutePathOf(url: string): string {
-  return path.join(env.GIT_WORKSPACE_DIR, 'public', url.replace(/^\/+/, ''));
-}
-
-/** Sprechender Name fuer ein Bild aus einem Textbereich. */
-function contentImageName(section: string, key: string, content: any): string {
-  if (section === 'welcome' && key === 'imageUrl') return 'willkommen';
-  if (section === 'drinks' && key === 'monthlySpecialImage') {
-    return content?.monthlySpecialName || 'monats-hit';
-  }
-  const whiskey = /^whiskeyImage(\d)$/.exec(key);
-  if (whiskey) return `whiskey-${whiskey[1]}`;
-  return `${section}-bild`;
-}
-
-function asObject(value: any): Record<string, any> {
-  if (!value) return {};
-  if (typeof value === 'string') {
-    try {
-      const parsed = JSON.parse(value);
-      return parsed && typeof parsed === 'object' ? parsed : {};
-    } catch {
-      return {};
-    }
-  }
-  return typeof value === 'object' ? value : {};
-}
-
-async function collectCandidates(): Promise<Candidate[]> {
-  const byUrl = new Map<string, string>();
-
-  const remember = (url: any, name: string) => {
-    if (typeof url !== 'string' || !url.startsWith('/images/')) return;
-    if (!byUrl.has(url)) byUrl.set(url, name);
-  };
-
-  for (const row of (await db.select().from(events)) as any[]) {
-    remember(row.imageUrl, row.title);
-  }
-
-  for (const row of (await db.select().from(galleryImages)) as any[]) {
-    remember(row.imageUrl, row.altText);
-  }
-
-  for (const row of (await db.select().from(contentSections)) as any[]) {
-    const content = asObject(row.contentJson);
-    for (const [key, value] of Object.entries(content)) {
-      remember(value, contentImageName(row.sectionName, key, content));
-    }
-  }
-
-  return [...byUrl.entries()].map(([url, preferredName]) => ({ url, preferredName }));
-}
-
-async function main() {
-  console.log(APPLY ? '=== Umwandlung nach AVIF ===' : '=== Vorschau (nichts wird geschrieben) ===\n');
-
-  initDatabase();
-
-  // Workspace auf den Stand des Repos bringen
-  const git = new GitService();
-  await git.initialize();
-  console.log(`Workspace: ${env.GIT_WORKSPACE_DIR}\n`);
-
-  const candidates = await collectCandidates();
-  const mapping = new Map<string, string>();
-
-  let bytesBefore = 0;
-  let bytesAfter = 0;
-  let skipped = 0;
-  let missing = 0;
-
-  for (const { url, preferredName } of candidates) {
-    const subdir = subdirOf(url);
-
-    if (!subdir) {
-      console.log(`  uebersprungen (ausserhalb der Upload-Ordner): ${url}`);
-      skipped++;
-      continue;
-    }
-
-    if (url.toLowerCase().endsWith('.avif')) {
-      skipped++;
-      continue;
-    }
-
-    const source = absolutePathOf(url);
-    if (!assets.resolveInDirs(url, MANAGED_IMAGE_DIRS) || !fs.existsSync(source)) {
-      console.log(`  FEHLT auf der Platte, Verweis bleibt: ${url}`);
-      missing++;
-      continue;
-    }
-
-    const input = fs.readFileSync(source);
-    bytesBefore += input.length;
-
-    if (!APPLY) {
-      console.log(`  ${url}  (${(input.length / 1024).toFixed(0)} KB)  ->  benannt nach "${preferredName}"`);
-      continue;
-    }
-
-    const saved = await saveImageBuffer(input, subdir, { preferredName });
-    const outSize = fs.statSync(absolutePathOf(saved.imageUrl)).size;
-    bytesAfter += outSize;
-    mapping.set(url, saved.imageUrl);
-
-    console.log(
-      `  ${url}  ${(input.length / 1024).toFixed(0)} KB  ->  ${saved.imageUrl}  ${(outSize / 1024).toFixed(0)} KB`
-    );
-  }
-
-  if (!APPLY) {
-    console.log(`\n${candidates.length - skipped - missing} Bild(er) wuerden umgewandelt.`);
-    console.log(`Gesamtgroesse aktuell: ${(bytesBefore / 1024 / 1024).toFixed(2)} MB`);
-    console.log('\nZum Ausfuehren: node dist/scripts/convert-images-to-avif.js --apply');
-    return;
-  }
-
-  if (mapping.size === 0) {
-    console.log('\nNichts umzuwandeln.');
-    return;
-  }
-
-  // Verweise in der Datenbank nachziehen
-  for (const row of (await db.select().from(events)) as any[]) {
-    const next = mapping.get(row.imageUrl);
-    if (next) await db.update(events).set({ imageUrl: next }).where(eq(events.id, row.id));
-  }
-
-  for (const row of (await db.select().from(galleryImages)) as any[]) {
-    const next = mapping.get(row.imageUrl);
-    if (next) await db.update(galleryImages).set({ imageUrl: next }).where(eq(galleryImages.id, row.id));
-  }
-
-  for (const row of (await db.select().from(contentSections)) as any[]) {
-    const updated = replaceImageUrls(asObject(row.contentJson), mapping);
-    await db
-      .update(contentSections)
-      .set({ contentJson: updated, updatedAt: new Date() })
-      .where(eq(contentSections.sectionName, row.sectionName));
-  }
-
-  console.log('\nVerweise in der Datenbank aktualisiert.');
-
-  // Vorgaenger wegraeumen - dropImageIfUnused loescht nur, was das CMS
-  // selbst angelegt hat. Handgepflegte Dateien wie event_karaoke.jpg
-  // bleiben liegen, obwohl jetzt eine AVIF-Fassung existiert.
-  let removed = 0;
-  let kept = 0;
-
-  for (const oldUrl of mapping.keys()) {
-    if (await dropImageIfUnused(oldUrl)) {
-      removed++;
-    } else if (fs.existsSync(absolutePathOf(oldUrl))) {
-      console.log(`  Original behalten (nicht vom CMS angelegt): ${oldUrl}`);
-      kept++;
-    }
-  }
-
-  console.log(`\n${mapping.size} Bild(er) umgewandelt, ${removed} Original(e) entfernt, ${kept} behalten.`);
-  console.log(
-    `Groesse: ${(bytesBefore / 1024 / 1024).toFixed(2)} MB  ->  ${(bytesAfter / 1024 / 1024).toFixed(2)} MB` +
-    ` (${(100 - (bytesAfter / bytesBefore) * 100).toFixed(1)} % gespart)`
-  );
-
-  const hash = await git.commitAndPush('Bestandsbilder nach AVIF umgewandelt');
-  console.log(`\nCommit: ${hash}`);
-  console.log('Fertig. Woodpecker baut die Seite jetzt neu.');
-}
-
-main()
-  .then(() => process.exit(0))
-  .catch((err) => {
-    console.error('\nFehlgeschlagen:', err);
-    process.exit(1);
-  });

backend/src/scripts/migrate-old-data.ts

@@ -1,190 +0,0 @@
-import { db } from '../config/database.js';
-import { events, galleryImages } from '../db/schema.js';
-import fs from 'fs';
-import path from 'path';
-import sharp from 'sharp';
-
-// Old events data
-const oldEvents = [
-  {
-    image: "/images/events/event_karaoke.jpg",
-    title: "Karaoke",
-    date: "2025-12-31", // Set as ongoing event
-    description: `Bei uns gibt es Karaoke Mi-Sa!! <br>
-Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>
-Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>`,
-    displayOrder: 0,
-  },
-  {
-    image: "/images/events/event_pub-quiz.jpg",
-    title: "Pub Quiz",
-    date: "2025-12-31", // Set as ongoing event
-    description: `Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>
-Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>
-Auch Einzelpersonen sind herzlich willkommen! <br>
-*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF`,
-    displayOrder: 1,
-  },
-  {
-    image: "/images/events/event_schlager-karaoke.jpeg",
-    title: "Schlager Hüttenzauber Karaoke",
-    date: "2025-11-27",
-    description: `Ab 19:00 Uhr Eintritt ist Frei! Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>`,
-    displayOrder: 2,
-  },
-  {
-    image: "/images/events/event_advents-kalender.jpeg",
-    title: "Adventskalender",
-    date: "2025-12-20",
-    description: `Jeden Tag neue Überraschungen! Check unsere Social Media Stories!`,
-    displayOrder: 3,
-  },
-  {
-    image: "/images/events/event_santa_karaoke.jpeg",
-    title: "Santa Karaoke-Party",
-    date: "2025-12-06",
-    description: `🤶🏻🎅🏻Komme als Weihnachts-Mann/-Frau und bekomme einen Shot auf's Haus!🤶🏻🎅🏻`,
-    displayOrder: 4,
-  },
-  {
-    image: "/images/events/event_ferien.jpeg",
-    title: "Weihnachtsferien",
-    date: "2025-12-21",
-    description: `Wir sind ab 02.01.2026 wieder wie gewohnt für euch da! 🍀. <br> Für Anfragen WA <a href="tel:+41772322770">077 232 27 70</a> Antwort innerhalb 48h`,
-    displayOrder: 5,
-  },
-  {
-    image: "/images/events/event_neujahrs-apero.jpeg",
-    title: "Neujahrs-Apero",
-    date: "2026-01-02",
-    description: `18:00-20:00 Uhr`,
-    displayOrder: 6,
-  },
-];
-
-// Old gallery images
-const oldGalleryImages = [
-  { src: "/images/gallery/Gallery7.png", alt: "Gallery 7" },
-  { src: "/images/gallery/Gallery8.png", alt: "Gallery 8" },
-  { src: "/images/gallery/Gallery9.png", alt: "Gallery 9" },
-  { src: "/images/gallery/Gallery6.png", alt: "Gallery 6" },
-  { src: "/images/gallery/Gallery1.png", alt: "Gallery 1" },
-  { src: "/images/gallery/Gallery2.png", alt: "Gallery 2" },
-  { src: "/images/gallery/Gallery3.png", alt: "Gallery 3" },
-  { src: "/images/gallery/Gallery4.png", alt: "Gallery 4" },
-  { src: "/images/gallery/Gallery5.png", alt: "Gallery 5" },
-];
-
-async function copyAndConvertImage(
-  sourcePath: string,
-  destDir: string,
-  filename: string
-): Promise<string> {
-  const projectRoot = path.join(process.cwd(), '..');
-  const fullSourcePath = path.join(projectRoot, 'public', sourcePath);
-
-  // Ensure destination directory exists
-  if (!fs.existsSync(destDir)) {
-    fs.mkdirSync(destDir, { recursive: true });
-  }
-
-  const ext = path.extname(filename);
-  const baseName = path.basename(filename, ext);
-  const webpFilename = `${baseName}.webp`;
-  const destPath = path.join(destDir, webpFilename);
-
-  console.log(`Processing: ${fullSourcePath} -> ${destPath}`);
-
-  // Check if source exists
-  if (!fs.existsSync(fullSourcePath)) {
-    console.error(`Source file not found: ${fullSourcePath}`);
-    throw new Error(`Source file not found: ${fullSourcePath}`);
-  }
-
-  // Convert to webp and copy
-  await sharp(fullSourcePath)
-    .rotate() // Auto-rotate based on EXIF
-    .resize({ width: 1600, withoutEnlargement: true })
-    .webp({ quality: 85 })
-    .toFile(destPath);
-
-  return `/images/${path.relative(destDir, destPath).replace(/\\/g, '/')}`;
-}
-
-async function migrateEvents() {
-  console.log('\n=== Migrating Events ===\n');
-
-  const dataDir = process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
-  const eventsImageDir = path.join(dataDir, 'images', 'events');
-
-  for (const event of oldEvents) {
-    try {
-      const filename = path.basename(event.image);
-      const newImageUrl = await copyAndConvertImage(
-        event.image,
-        eventsImageDir,
-        filename
-      );
-
-      const [newEvent] = await db.insert(events).values({
-        title: event.title,
-        date: event.date,
-        description: event.description,
-        imageUrl: newImageUrl,
-        displayOrder: event.displayOrder,
-        isPublished: true,
-      }).returning();
-
-      console.log(`✓ Migrated event: ${newEvent.title}`);
-    } catch (error) {
-      console.error(`✗ Failed to migrate event "${event.title}":`, error);
-    }
-  }
-}
-
-async function migrateGallery() {
-  console.log('\n=== Migrating Gallery Images ===\n');
-
-  const dataDir = process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
-  const galleryImageDir = path.join(dataDir, 'images', 'gallery');
-
-  for (let i = 0; i < oldGalleryImages.length; i++) {
-    const img = oldGalleryImages[i];
-    try {
-      const filename = path.basename(img.src);
-      const newImageUrl = await copyAndConvertImage(
-        img.src,
-        galleryImageDir,
-        filename
-      );
-
-      const [newImage] = await db.insert(galleryImages).values({
-        imageUrl: newImageUrl,
-        altText: img.alt,
-        displayOrder: i,
-        isPublished: true,
-      }).returning();
-
-      console.log(`✓ Migrated gallery image: ${newImage.altText}`);
-    } catch (error) {
-      console.error(`✗ Failed to migrate gallery image "${img.alt}":`, error);
-    }
-  }
-}
-
-async function main() {
-  console.log('Starting migration of old data...\n');
-  console.log('Working directory:', process.cwd());
-  console.log('Data directory:', process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data'));
-
-  try {
-    await migrateEvents();
-    await migrateGallery();
-    console.log('\n✓ Migration completed successfully!');
-  } catch (error) {
-    console.error('\n✗ Migration failed:', error);
-    process.exit(1);
-  }
-}
-
-main();

backend/src/services/asset.service.ts

@@ -1,94 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { env } from '../config/env.js';
-
-/**
- * Kennt die Verzeichnisse, in die das CMS schreibt, und sorgt dafuer, dass
- * kein Pfad ausserhalb davon angefasst wird.
- *
- * Ob eine konkrete Datei geloescht werden DARF, entscheidet diese Klasse
- * bewusst nicht - das steht in managed-assets.service.ts.
- */
-
-// Unterordner unterhalb von public/
-export const MANAGED_IMAGE_DIRS = ['images/events', 'images/gallery', 'images/content'];
-export const MANAGED_PDF_DIR = 'pdf';
-
-export class AssetService {
-  private publicDir: string;
-
-  constructor() {
-    this.publicDir = path.join(env.GIT_WORKSPACE_DIR, 'public');
-  }
-
-  /** Absoluter Pfad im public-Verzeichnis, oder null wenn ausserhalb. */
-  private resolveInPublic(url: string): string | null {
-    if (!url || typeof url !== 'string' || !url.startsWith('/')) return null;
-
-    const relative = url.replace(/^\/+/, '').split('?')[0].split('#')[0];
-    const absolute = path.resolve(this.publicDir, relative);
-
-    // Traversal-Schutz: muss unterhalb von public/ bleiben
-    if (absolute !== this.publicDir && !absolute.startsWith(this.publicDir + path.sep)) {
-      return null;
-    }
-
-    return absolute;
-  }
-
-  /** Absoluter Pfad, sofern die Datei in einem der erlaubten Ordner liegt. */
-  resolveInDirs(url: string, dirs: string[]): string | null {
-    const absolute = this.resolveInPublic(url);
-    if (!absolute) return null;
-
-    const relative = path.relative(this.publicDir, absolute);
-    const dir = path.dirname(relative).split(path.sep).join('/');
-
-    return dirs.includes(dir) ? absolute : null;
-  }
-
-  /** Existiert die Datei bereits? Fuer die Namensvergabe. */
-  exists(url: string, dirs: string[]): boolean {
-    const absolute = this.resolveInDirs(url, dirs);
-    return absolute ? fs.existsSync(absolute) : false;
-  }
-
-  /** Loescht eine Bilddatei. Die Besitzfrage muss vorher geklaert sein. */
-  deleteImage(url: string): boolean {
-    return this.unlink(this.resolveInDirs(url, MANAGED_IMAGE_DIRS));
-  }
-
-  /** Loescht ein PDF. Die Besitzfrage muss vorher geklaert sein. */
-  deletePdf(url: string): boolean {
-    return this.unlink(this.resolveInDirs(url, [MANAGED_PDF_DIR]));
-  }
-
-  private unlink(absolute: string | null): boolean {
-    if (!absolute) return false;
-    try {
-      fs.unlinkSync(absolute);
-      return true;
-    } catch (err: any) {
-      if (err?.code === 'ENOENT') return false;
-      throw err;
-    }
-  }
-
-  /** Alle Bilddateien, die in den verwalteten Ordnern liegen, als URL-Pfade. */
-  listImageFiles(): string[] {
-    const found: string[] = [];
-
-    for (const dir of MANAGED_IMAGE_DIRS) {
-      const absoluteDir = path.join(this.publicDir, dir);
-      if (!fs.existsSync(absoluteDir)) continue;
-
-      for (const name of fs.readdirSync(absoluteDir)) {
-        const absolute = path.join(absoluteDir, name);
-        if (!fs.statSync(absolute).isFile()) continue;
-        found.push(`/${dir}/${name}`);
-      }
-    }
-
-    return found;
-  }
-}

backend/src/services/file-generator.service.ts

@@ -1,262 +0,0 @@
-import { writeFile } from 'fs/promises';
-import path from 'path';
-
-interface Event {
-  title: string;
-  date: string;
-  description: string;
-  imageUrl: string;
-}
-
-interface GalleryImage {
-  imageUrl: string;
-  altText: string;
-}
-
-interface ContentSection {
-  [key: string]: any;
-}
-
-export class FileGeneratorService {
-
-  escapeQuotes(str: string): string {
-    return str.replace(/"/g, '\\"');
-  }
-
-  escapeBackticks(str: string): string {
-    return str.replace(/`/g, '\\`').replace(/\${/g, '\\${');
-  }
-
-  /**
-   * Texte aus dem Adminbereich landen direkt im Astro-Markup. Ohne Maskierung
-   * reicht ein "<" oder "&" in einem Feld, damit der Build der Seite scheitert
-   * und der Deploy stehen bleibt.
-   */
-  escapeHtml(value: any): string {
-    if (value === undefined || value === null) return '';
-    return String(value)
-      .replace(/&/g, '&amp;')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#39;');
-  }
-
-  /** Wie escapeHtml, aber mit Rueckfallwert wenn nichts gesetzt ist. */
-  text(value: any, fallback = ''): string {
-    const raw = value === undefined || value === null || value === '' ? fallback : value;
-    return this.escapeHtml(raw);
-  }
-
-  generateIndexAstro(events: Event[], images: GalleryImage[]): string {
-    const eventsCode = events.map(e => `\t{
-\t\timage: "${e.imageUrl}",
-\t\ttitle: "${this.escapeQuotes(e.title)}",
-\t\tdate: "${e.date}",
-\t\tdescription: \`
-\t\t\t${this.escapeBackticks(e.description)}
-\t\t\`,
-\t}`).join(',\n');
-
-    const imagesCode = images.map(g =>
-      `\t{ src: "${g.imageUrl}", alt: "${this.escapeQuotes(g.altText)}" }`
-    ).join(',\n');
-
-    return `---
-import Layout from "../components/Layout.astro";
-import Banner from "../components/Banner.astro";
-import Hero from "../components/Hero.astro";
-import Welcome from "../components/Welcome.astro";
-import EventsGrid from "../components/EventsGrid.astro";
-import Drinks from "../components/Drinks.astro";
-import ImageCarousel from "../components/ImageCarousel.astro";
-import Contact from "../components/Contact.astro";
-import About from "../components/About.astro";
-
-const events = [
-${eventsCode}
-];
-
-const images = [
-${imagesCode}
-];
----
-
-<Layout>
-\t<Hero id="hero" />
-\t<Banner />
-\t<Welcome id="welcome" />
-\t<EventsGrid id="events" events={events} />
-\t<ImageCarousel id="gallery" images={images} />
-\t<Drinks id="drinks" />
-</Layout>
-`;
-  }
-
-  generateHeroComponent(content: ContentSection): string {
-    return `---
-// src/components/Hero.astro
-import "../styles/components/Hero.css"
-
-const { id } = Astro.props;
----
-
-<section id={id} class="hero container">
-
-\t<div class="hero-overlay">
-
-\t\t<div class="hero-content">
-
-\t\t\t<h1>${this.text(content.heading, 'Dein Irish Pub')}</h1>
-
-\t\t\t<p>${this.text(content.subheading, 'Im Herzen von St.Gallen')}</p>
-
-\t\t\t<a href="#" class="button">Aktuelles ↓</a>
-\t\t</div>
-
-\t</div>
-
-</section>
-
-<style>
-
-</style>
-`;
-  }
-
-  generateWelcomeComponent(content: ContentSection): string {
-    const highlightsList = (content.highlights || []).map((h: any) =>
-      `\t\t\t<li>\n\t\t\t\t<b>${this.escapeHtml(h?.title)}:</b> ${this.escapeHtml(h?.description)}\n\t\t\t</li>`
-    ).join('\n\n');
-
-    return `---
-// src/components/Welcome.astro
-import "../styles/components/Welcome.css"
-
-const { id } = Astro.props;
----
-
-<section id={id} class="welcome container">
-
-\t<div class="welcome-text">
-
-\t\t<h2>${this.text(content.heading1, 'Herzlich willkommen im')}</h2>
-\t\t<h2>${this.text(content.heading2, 'Gallus Pub!')}</h2>
-
-\t\t<p>
-\t\t\t${this.text(content.introText)}
-\t\t</p>
-
-\t\t<p><b>Unsere Highlights:</b></p>
-
-\t\t<ul>
-${highlightsList}
-\t\t</ul>
-
-\t\t<p>
-\t\t\t${this.text(content.closingText)}
-\t\t</p>
-
-\t</div>
-
-
-\t<div class="welcome-image">
-\t\t<img src="${this.text(content.imageUrl, '/images/Welcome.png')}" alt="Welcome background image" />
-\t</div>
-
-</section>
-`;
-  }
-
-  generateDrinksComponent(content: ContentSection): string {
-    return `---
-import "../styles/components/Drinks.css"
-
-const { id } = Astro.props;
----
-<section id={id} class="Drinks">
-    <h2 class="title">Drinks</h2>
-
-    <p class="note">
-        ${this.text(content.introText, 'Ob ein frisch gezapftes Pint, ein edler Tropfen Whiskey oder ein gemütliches Glas Wein – hier kannst du in entspannter Atmosphäre das Leben genießen.')}
-    </p>
-
-    <a href="${this.text(content.pdfUrl, '/pdf/Getraenke_Gallus_2025.pdf')}" class="card-link" target="_blank" rel="noopener noreferrer">Getränkekarte</a>
-
-    <h3 class="monats-hit">Monats Hit</h3>
-
-    <div class="mate-vodka">
-        <div class="circle" title="${this.text(content.monthlySpecialName, 'Mate Vodka')}">
-            <img src="${this.text(content.monthlySpecialImage, '/images/MonthlyHit.png')}" alt="Monats Hit" class="circle-image" />
-            <span class="circle-label"></span>
-        </div>
-        <div>${this.text(content.monthlySpecialName, 'Mate Vodka')}</div>
-    </div>
-
-    <p class="note">
-        ${this.text(content.whiskeyText, 'Für Whisky-Liebhaber haben wir erlesene Sorten aus Schottland und Irland im Angebot.')}
-    </p>
-
-    <div class="circle-row">
-        <div class="circle whiskey-circle" title="Whiskey 1">
-            <img src="${this.text(content.whiskeyImage1, '/images/Whiskey1.png')}" alt="Whiskey 1" class="circle-image" />
-            <span class="circle-label"></span>
-        </div>
-        <div class="circle whiskey-circle" title="Whiskey 2">
-            <img src="${this.text(content.whiskeyImage2, '/images/Whiskey2.png')}" alt="Whiskey 2" class="circle-image" />
-            <span class="circle-label"></span>
-        </div>
-        <div class="circle whiskey-circle" title="Whiskey 3">
-            <img src="${this.text(content.whiskeyImage3, '/images/Whiskey3.png')}" alt="Whiskey 3" class="circle-image" />
-            <span class="circle-label"></span>
-        </div>
-    </div>
-</section>
-`;
-  }
-
-  async writeFiles(
-    workspaceDir: string,
-    events: Event[],
-    images: GalleryImage[],
-    sections: Map<string, ContentSection>
-  ) {
-    // Write index.astro
-    const indexContent = this.generateIndexAstro(events, images);
-    await writeFile(
-      path.join(workspaceDir, 'src/pages/index.astro'),
-      indexContent,
-      'utf-8'
-    );
-
-    // Write Hero component
-    if (sections.has('hero')) {
-      const heroContent = this.generateHeroComponent(sections.get('hero')!);
-      await writeFile(
-        path.join(workspaceDir, 'src/components/Hero.astro'),
-        heroContent,
-        'utf-8'
-      );
-    }
-
-    // Write Welcome component
-    if (sections.has('welcome')) {
-      const welcomeContent = this.generateWelcomeComponent(sections.get('welcome')!);
-      await writeFile(
-        path.join(workspaceDir, 'src/components/Welcome.astro'),
-        welcomeContent,
-        'utf-8'
-      );
-    }
-
-    // Write Drinks component
-    if (sections.has('drinks')) {
-      const drinksContent = this.generateDrinksComponent(sections.get('drinks')!);
-      await writeFile(
-        path.join(workspaceDir, 'src/components/Drinks.astro'),
-        drinksContent,
-        'utf-8'
-      );
-    }
-  }
-}

backend/src/services/git.service.ts

@@ -1,133 +0,0 @@
-import simpleGit, { SimpleGit } from 'simple-git';
-import { mkdir, rm, cp } from 'fs/promises';
-import { existsSync } from 'fs';
-import path from 'path';
-import { env } from '../config/env.js';
-
-// Verzeichnisse, in die das CMS hochlaedt. Die muessen einen Neu-Clone des
-// Workspace ueberleben, sonst sind Bilder und Getraenkekarte weg.
-const UPLOAD_DIRS = [
-  path.join('public', 'images'),
-  path.join('public', 'pdf'),
-];
-
-export class GitService {
-  private git: SimpleGit;
-  private workspaceDir: string;
-  private parentDir: string;
-  private repoUrl: string;
-  private token: string;
-
-  constructor() {
-    this.workspaceDir = env.GIT_WORKSPACE_DIR;
-    this.parentDir = path.dirname(this.workspaceDir);
-    this.repoUrl = env.GIT_REPO_URL;
-    this.token = env.GIT_TOKEN;
-    this.git = simpleGit();
-  }
-
-  async initialize() {
-    // Elternverzeichnis muss existieren - simple-git startet git von dort aus
-    await mkdir(this.parentDir, { recursive: true });
-
-    // Add token to repo URL for authentication
-    const authenticatedUrl = this.repoUrl.replace(
-      'https://',
-      `https://oauth2:${encodeURIComponent(this.token)}@`
-    );
-
-    let usable = false;
-
-    if (existsSync(path.join(this.workspaceDir, '.git'))) {
-      try {
-        this.git = simpleGit(this.workspaceDir);
-        await this.git.status();
-        console.log('Repository already exists, pulling latest...');
-        await this.git.pull();
-        usable = true;
-      } catch (error) {
-        // Token aus der Meldung entfernen - git gibt die Remote-URL mit aus
-        const msg = error instanceof Error ? error.message : String(error);
-        console.warn(
-          'Existing workspace unusable, re-cloning:',
-          msg.replace(/\/\/[^@\s/]*@/g, '//***@')
-        );
-      }
-    }
-
-    if (!usable) {
-      console.log('Cloning repository...');
-
-      // Hochgeladene Dateien liegen im Workspace und wuerden beim Loeschen
-      // verschwinden - vorher wegsichern, nach dem Clone zurueckspielen
-      const backupRoot = path.join(this.parentDir, '.workspace-upload-backup');
-      await rm(backupRoot, { recursive: true, force: true });
-
-      const saved: string[] = [];
-      for (const relative of UPLOAD_DIRS) {
-        const source = path.join(this.workspaceDir, relative);
-        if (!existsSync(source)) continue;
-        await cp(source, path.join(backupRoot, relative), { recursive: true });
-        saved.push(relative);
-      }
-
-      await rm(this.workspaceDir, { recursive: true, force: true });
-
-      // Aus dem existierenden Elternverzeichnis klonen, nicht aus dem
-      // soeben geloeschten Zielverzeichnis (sonst: spawn git ENOENT)
-      this.git = simpleGit(this.parentDir);
-      await this.git.clone(authenticatedUrl, this.workspaceDir);
-      this.git = simpleGit(this.workspaceDir);
-
-      for (const relative of saved) {
-        // force: false -> was schon im Repo liegt, bleibt unangetastet
-        await cp(path.join(backupRoot, relative), path.join(this.workspaceDir, relative), {
-          recursive: true,
-          force: false,
-          errorOnExist: false,
-        });
-      }
-
-      await rm(backupRoot, { recursive: true, force: true });
-    }
-
-    // Configure git user
-    await this.git.addConfig('user.name', env.GIT_USER_NAME);
-    await this.git.addConfig('user.email', env.GIT_USER_EMAIL);
-  }
-
-  async commitAndPush(message: string): Promise<string> {
-    await this.git.add('.');
-
-    const status = await this.git.status();
-    if (status.isClean()) {
-      // Nichts zu committen - aktuellen Stand zurueckgeben statt zu scheitern
-      const current = await this.git.log({ maxCount: 1 });
-      return current.latest?.hash || '';
-    }
-
-    await this.git.commit(message);
-    await this.git.push('origin', 'main');
-
-    const log = await this.git.log({ maxCount: 1 });
-    return log.latest?.hash || '';
-  }
-
-  getWorkspacePath(relativePath: string): string {
-    return path.join(this.workspaceDir, relativePath);
-  }
-
-  async reset() {
-    // Nur zuruecksetzen wenn wirklich ein Repo da ist - sonst laeuft git
-    // im Prozess-Arbeitsverzeichnis und raeumt dort auf
-    if (!existsSync(path.join(this.workspaceDir, '.git'))) {
-      return;
-    }
-
-    const git = simpleGit(this.workspaceDir);
-    await git.reset(['--hard', 'HEAD']);
-    // Uploads ausnehmen - die sind noch nicht committed und waeren sonst weg
-    const excludes = UPLOAD_DIRS.flatMap((dir) => ['-e', dir.split(path.sep).join('/')]);
-    await git.clean('f', ['-d', ...excludes]);
-  }
-}

backend/src/services/gitea.service.ts

@@ -1,112 +0,0 @@
-import crypto from 'crypto';
-import { env } from '../config/env.js';
-
-interface GiteaUser {
-  id: number;
-  login: string;
-  email: string;
-  full_name: string;
-  avatar_url: string;
-}
-
-interface OAuthTokenResponse {
-  access_token: string;
-  token_type: string;
-  expires_in: number;
-  refresh_token?: string;
-}
-
-export class GiteaService {
-  private giteaUrl: string;
-  private clientId: string;
-  private clientSecret: string;
-  private redirectUri: string;
-  private allowedUsers: Set<string>;
-
-  constructor() {
-    this.giteaUrl = env.GITEA_URL;
-    this.clientId = env.GITEA_CLIENT_ID;
-    this.clientSecret = env.GITEA_CLIENT_SECRET;
-    this.redirectUri = env.GITEA_REDIRECT_URI;
-
-    const allowed = env.GITEA_ALLOWED_USERS;
-    this.allowedUsers = new Set(allowed.split(',').map(u => u.trim()).filter(Boolean));
-  }
-
-  /**
-   * Generate OAuth authorization URL
-   */
-  getAuthorizationUrl(state: string): string {
-    const params = new URLSearchParams({
-      client_id: this.clientId,
-      redirect_uri: this.redirectUri,
-      response_type: 'code',
-      state,
-      scope: 'read:user',
-    });
-
-    return `${this.giteaUrl}/login/oauth/authorize?${params.toString()}`;
-  }
-
-  /**
-   * Exchange authorization code for access token
-   */
-  async exchangeCodeForToken(code: string): Promise<OAuthTokenResponse> {
-    const response = await fetch(`${this.giteaUrl}/login/oauth/access_token`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Accept': 'application/json',
-      },
-      body: JSON.stringify({
-        client_id: this.clientId,
-        client_secret: this.clientSecret,
-        code,
-        redirect_uri: this.redirectUri,
-        grant_type: 'authorization_code',
-      }),
-    });
-
-    if (!response.ok) {
-      throw new Error(`Failed to exchange code: ${response.statusText}`);
-    }
-
-    return await response.json();
-  }
-
-  /**
-   * Fetch user info from Gitea using access token
-   */
-  async getUserInfo(accessToken: string): Promise<GiteaUser> {
-    const response = await fetch(`${this.giteaUrl}/api/v1/user`, {
-      headers: {
-        'Authorization': `Bearer ${accessToken}`,
-        'Accept': 'application/json',
-      },
-    });
-
-    if (!response.ok) {
-      throw new Error(`Failed to fetch user info: ${response.statusText}`);
-    }
-
-    return await response.json();
-  }
-
-  /**
-   * Check if user is allowed to access the CMS
-   */
-  isUserAllowed(username: string): boolean {
-    // If no allowed users specified, allow all
-    if (this.allowedUsers.size === 0) {
-      return true;
-    }
-    return this.allowedUsers.has(username);
-  }
-
-  /**
-   * Generate random state for CSRF protection
-   */
-  generateState(): string {
-    return crypto.randomBytes(32).toString('hex');
-  }
-}

backend/src/services/image-refs.service.ts

@@ -1,128 +0,0 @@
-import { db } from '../config/database.js';
-import { events, galleryImages, contentSections } from '../db/schema.js';
-import { AssetService } from './asset.service.js';
-import { isManagedAsset, forgetManagedAsset } from './managed-assets.service.js';
-
-const assets = new AssetService();
-
-/**
- * Loescht eine Bilddatei, sofern das CMS sie selbst angelegt hat und kein
- * Datensatz sie mehr benutzt. Muss NACH dem Loeschen bzw. Aktualisieren der
- * Zeile aufgerufen werden.
- */
-export async function dropImageIfUnused(url: string | null | undefined): Promise<boolean> {
-  if (!url) return false;
-  if (!(await isManagedAsset(url))) return false;
-
-  const referenced = await collectReferencedImageUrls();
-  if (referenced.has(url)) return false;
-
-  const deleted = assets.deleteImage(url);
-  await forgetManagedAsset(url);
-  return deleted;
-}
-
-/**
- * Entfernt alle vom CMS angelegten Bilder, die nirgends mehr referenziert
- * werden. Die Referenzliste deckt bewusst ALLE Zeilen ab, auch
- * unveroeffentlichte - sonst verlieren die ihr Bild.
- */
-export async function sweepOrphanedImages(): Promise<string[]> {
-  const referenced = await collectReferencedImageUrls();
-  const removed: string[] = [];
-
-  for (const url of assets.listImageFiles()) {
-    if (referenced.has(url)) continue;
-    if (!(await isManagedAsset(url))) continue;
-
-    if (assets.deleteImage(url)) removed.push(url);
-    await forgetManagedAsset(url);
-  }
-
-  return removed;
-}
-
-/**
- * Sammelt jede Bild-URL, die irgendwo in der Datenbank vorkommt.
- *
- * Bewusst ueber ALLE Zeilen, nicht nur die veroeffentlichten - sonst wuerde
- * ein unveroeffentlichtes Event sein Bild verlieren, sobald jemand publisht.
- *
- * Die Content-Sections enthalten beliebiges JSON (Welcome-Bild, Monatshit,
- * Whiskey-Bilder), deshalb wird es rekursiv nach Bildpfaden durchsucht.
- */
-export async function collectReferencedImageUrls(): Promise<Set<string>> {
-  const urls = new Set<string>();
-
-  for (const row of (await db.select().from(events)) as any[]) {
-    if (row.imageUrl) urls.add(row.imageUrl);
-  }
-
-  for (const row of (await db.select().from(galleryImages)) as any[]) {
-    if (row.imageUrl) urls.add(row.imageUrl);
-  }
-
-  for (const row of (await db.select().from(contentSections)) as any[]) {
-    collectFromJson(row.contentJson, urls);
-  }
-
-  return urls;
-}
-
-/**
- * Ersetzt Bildpfade in einem beliebigen Content-JSON anhand einer Zuordnung
- * alt -> neu. Die Struktur bleibt dabei unveraendert.
- */
-export function replaceImageUrls(value: any, mapping: Map<string, string>): any {
-  if (typeof value === 'string') {
-    return mapping.get(value) ?? value;
-  }
-
-  if (Array.isArray(value)) {
-    return value.map((entry) => replaceImageUrls(entry, mapping));
-  }
-
-  if (value && typeof value === 'object') {
-    const out: Record<string, any> = {};
-    for (const [key, entry] of Object.entries(value)) {
-      out[key] = replaceImageUrls(entry, mapping);
-    }
-    return out;
-  }
-
-  return value;
-}
-
-/** Alle Bildpfade aus einem beliebigen Content-JSON. */
-export function extractImageUrls(value: any): Set<string> {
-  const out = new Set<string>();
-  collectFromJson(value, out);
-  return out;
-}
-
-function collectFromJson(value: any, out: Set<string>): void {
-  if (typeof value === 'string') {
-    if (value.startsWith('/images/')) {
-      out.add(value);
-      return;
-    }
-    // Je nach Treiber kommt das JSON als String zurueck
-    if (value.startsWith('{') || value.startsWith('[')) {
-      try {
-        collectFromJson(JSON.parse(value), out);
-      } catch {
-        // kein JSON - ignorieren
-      }
-    }
-    return;
-  }
-
-  if (Array.isArray(value)) {
-    for (const entry of value) collectFromJson(entry, out);
-    return;
-  }
-
-  if (value && typeof value === 'object') {
-    for (const entry of Object.values(value)) collectFromJson(entry, out);
-  }
-}

backend/src/services/managed-assets.service.ts

@@ -1,54 +0,0 @@
-import { eq } from 'drizzle-orm';
-import { db } from '../config/database.js';
-import { managedAssets } from '../db/schema.js';
-
-/**
- * Fuehrt Buch darueber, welche Dateien das CMS selbst angelegt hat.
- * Nur diese darf es spaeter wieder loeschen.
- */
-
-// Altbestand: vor der Umstellung auf sprechende Namen hiessen Uploads
-// <base36-zeitstempel>-<6 zeichen>.<ext>. Diese Dateien stehen nicht in der
-// Tabelle, sollen aber weiterhin aufgeraeumt werden koennen. Handgepflegte
-// Assets wie event_karaoke.jpg oder Gallery1.webp passen nicht auf das Muster.
-const LEGACY_NAME = /^[a-z0-9]{6,14}-[a-z0-9]{6}\.[a-z0-9]{2,5}$/i;
-
-function basename(urlPath: string): string {
-  return urlPath.split('/').pop() || '';
-}
-
-/** Merkt sich eine neu angelegte Datei. */
-export async function registerManagedAsset(urlPath: string): Promise<void> {
-  await db.insert(managedAssets).values({ path: urlPath }).onConflictDoNothing();
-}
-
-/** Vergisst eine Datei wieder (nach dem Loeschen). */
-export async function forgetManagedAsset(urlPath: string): Promise<void> {
-  await db.delete(managedAssets).where(eq(managedAssets.path, urlPath));
-}
-
-/** Darf das CMS diese Datei loeschen? */
-export async function isManagedAsset(urlPath: string): Promise<boolean> {
-  if (!urlPath) return false;
-
-  const [row] = await db
-    .select()
-    .from(managedAssets)
-    .where(eq(managedAssets.path, urlPath))
-    .limit(1);
-
-  if (row) return true;
-
-  return LEGACY_NAME.test(basename(urlPath));
-}
-
-/** Alle vom CMS angelegten Pfade aus der Tabelle. */
-export async function listManagedAssets(): Promise<string[]> {
-  const rows = (await db.select().from(managedAssets)) as any[];
-  return rows.map((row) => row.path as string);
-}
-
-/** Trifft der Altbestands-Namensstil zu? */
-export function hasLegacyName(urlPath: string): boolean {
-  return LEGACY_NAME.test(basename(urlPath));
-}

backend/src/services/media.service.ts

@@ -1,87 +0,0 @@
-import sharp from 'sharp';
-import { writeFile, mkdir } from 'fs/promises';
-import path from 'path';
-import crypto from 'crypto';
-import { env } from '../config/env.js';
-
-export class MediaService {
-  private allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
-  private maxFileSize: number;
-
-  constructor() {
-    this.maxFileSize = env.MAX_FILE_SIZE;
-  }
-
-  /**
-   * Validate file type and size
-   */
-  async validateFile(file: any): Promise<void> {
-    if (!this.allowedMimeTypes.includes(file.mimetype)) {
-      throw new Error(`Invalid file type. Allowed types: ${this.allowedMimeTypes.join(', ')}`);
-    }
-
-    // Check file size
-    const buffer = await file.toBuffer();
-    if (buffer.length > this.maxFileSize) {
-      throw new Error(`File too large. Maximum size: ${this.maxFileSize / 1024 / 1024}MB`);
-    }
-  }
-
-  /**
-   * Generate safe filename
-   */
-  generateFilename(originalName: string): string {
-    const ext = path.extname(originalName);
-    const hash = crypto.randomBytes(8).toString('hex');
-    const timestamp = Date.now();
-    return `${timestamp}-${hash}${ext}`;
-  }
-
-  /**
-   * Optimize and save image
-   */
-  async processAndSaveImage(
-    file: any,
-    destinationDir: string
-  ): Promise<{ filename: string; url: string }> {
-    await this.validateFile(file);
-
-    // Ensure destination directory exists
-    await mkdir(destinationDir, { recursive: true });
-
-    // Generate filename
-    const filename = this.generateFilename(file.filename);
-    const filepath = path.join(destinationDir, filename);
-
-    // Get file buffer
-    const buffer = await file.toBuffer();
-
-    // Process image with sharp (optimize and resize if needed)
-    await sharp(buffer)
-      .resize(2000, 2000, {
-        fit: 'inside',
-        withoutEnlargement: true,
-      })
-      .jpeg({ quality: 85 })
-      .png({ quality: 85 })
-      .webp({ quality: 85 })
-      .toFile(filepath);
-
-    // Return filename and URL path
-    return {
-      filename,
-      url: `/images/${filename}`,
-    };
-  }
-
-  /**
-   * Save image to git workspace
-   */
-  async saveToGitWorkspace(
-    file: any,
-    workspaceDir: string
-  ): Promise<{ filename: string; url: string }> {
-    const imagesDir = path.join(workspaceDir, 'public', 'images');
-    return this.processAndSaveImage(file, imagesDir);
-  }
-}

backend/src/services/upload.service.ts

@@ -1,161 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { env } from '../config/env.js';
-import { AssetService, MANAGED_IMAGE_DIRS, MANAGED_PDF_DIR } from './asset.service.js';
-import { registerManagedAsset } from './managed-assets.service.js';
-
-export type UploadSubdir = 'events' | 'gallery' | 'content';
-
-export interface SavedImage {
-  filename: string;
-  imageUrl: string;
-}
-
-const assets = new AssetService();
-
-/**
- * Macht aus "Karaoke-Abend im Gallus Pub!" -> "karaoke-abend-im-gallus-pub".
- * Umlaute werden ausgeschrieben, nicht entfernt, damit aus "Getränke" nicht
- * "getrnke" wird.
- */
-export function slugify(value: string): string {
-  const slug = String(value || '')
-    .replace(/ä/g, 'ae').replace(/ö/g, 'oe').replace(/ü/g, 'ue')
-    .replace(/Ä/g, 'Ae').replace(/Ö/g, 'Oe').replace(/Ü/g, 'Ue')
-    .replace(/ß/g, 'ss')
-    .normalize('NFD').replace(/[̀-ͯ]/g, '')
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 60)
-    .replace(/-+$/, '');
-
-  return slug;
-}
-
-/** Dateiname ohne Endung, wie er vor dem Upload hiess. */
-function originalBaseName(file: any): string {
-  const name = (file?.filename as string | undefined) || '';
-  return name.replace(/\.[^.]+$/, '');
-}
-
-/**
- * Sucht einen freien Namen. Gibt es <basis>.avif schon, wird -2, -3, ...
- * angehaengt, damit zwei Events namens "Karaoke" sich nicht ueberschreiben.
- */
-function findFreeName(base: string, ext: string, urlDir: string, dirs: string[]): string {
-  const safeBase = base || `datei-${Date.now().toString(36)}`;
-
-  for (let attempt = 1; attempt <= 500; attempt++) {
-    const candidate = attempt === 1 ? `${safeBase}${ext}` : `${safeBase}-${attempt}${ext}`;
-    if (!assets.exists(`${urlDir}/${candidate}`, dirs)) return candidate;
-  }
-
-  // Sollte nie eintreten - lieber ein haesslicher Name als eine Endlosschleife
-  return `${safeBase}-${Date.now().toString(36)}${ext}`;
-}
-
-/**
- * Nimmt einen Multipart-Upload entgegen, rechnet ihn auf 1600px herunter,
- * wandelt nach AVIF und legt ihn unter public/images/<subdir> ab.
- *
- * Der Name kommt aus preferredName (Event-Titel bzw. Alt-Text) und faellt
- * sonst auf den urspruenglichen Dateinamen zurueck.
- */
-export async function saveUploadedImage(
-  file: any,
-  subdir: UploadSubdir,
-  options: { preferredName?: string; log?: { warn: (obj: any, msg: string) => void } } = {}
-): Promise<SavedImage> {
-  const { preferredName, log } = options;
-
-  const chunks: Buffer[] = [];
-  for await (const chunk of file.file) {
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  }
-  const inputBuffer = Buffer.concat(chunks);
-
-  // Ohne diese Pruefung landet bei zu grossen Dateien ein abgeschnittenes,
-  // kaputtes Bild auf der Platte
-  if (file.file?.truncated) {
-    const limit = Math.round(env.MAX_FILE_SIZE / 1024 / 1024);
-    const error: any = new Error(`Image too large. Maximum is ${limit} MB`);
-    error.statusCode = 413;
-    throw error;
-  }
-
-  return saveImageBuffer(inputBuffer, subdir, {
-    preferredName: preferredName || originalBaseName(file),
-    fallbackExtension: '.' + ((file.mimetype || '').split('/')[1] || 'bin')
-      .replace(/[^a-z0-9]/gi, '').toLowerCase(),
-    log,
-  });
-}
-
-/**
- * Kern der Bildverarbeitung: verkleinern, nach AVIF wandeln, unter einem
- * sprechenden Namen ablegen und als CMS-eigene Datei vermerken.
- *
- * Wird sowohl vom Upload als auch vom Umwandlungsskript fuer den Altbestand
- * benutzt, damit beide Wege identisch arbeiten.
- */
-export async function saveImageBuffer(
-  inputBuffer: Buffer,
-  subdir: UploadSubdir,
-  options: {
-    preferredName?: string;
-    fallbackExtension?: string;
-    log?: { warn: (obj: any, msg: string) => void };
-  } = {}
-): Promise<SavedImage> {
-  const { preferredName, fallbackExtension = '.bin', log } = options;
-
-  const uploadDir = path.join(env.GIT_WORKSPACE_DIR, 'public', 'images', subdir);
-  fs.mkdirSync(uploadDir, { recursive: true });
-
-  let outBuffer: Buffer;
-  let outExt = '.avif';
-
-  try {
-    // Sharp erst laden wenn wirklich gebraucht
-    const sharp = (await import('sharp')).default;
-    outBuffer = await sharp(inputBuffer)
-      .rotate()
-      .resize({ width: 1600, withoutEnlargement: true })
-      .avif({ quality: 55 })
-      .toBuffer();
-  } catch (err) {
-    log?.warn({ err }, 'Sharp processing failed, using original image');
-    outBuffer = inputBuffer;
-    outExt = fallbackExtension;
-  }
-
-  const urlDir = `/images/${subdir}`;
-  const filename = findFreeName(slugify(preferredName || ''), outExt, urlDir, MANAGED_IMAGE_DIRS);
-
-  fs.writeFileSync(path.join(uploadDir, filename), outBuffer);
-
-  const imageUrl = `${urlDir}/${filename}`;
-  await registerManagedAsset(imageUrl);
-
-  return { filename, imageUrl };
-}
-
-/**
- * Legt ein hochgeladenes PDF unter public/pdf ab, benannt nach dem
- * urspruenglichen Dateinamen.
- */
-export async function saveUploadedPdf(file: any, buffer: Buffer, preferredName?: string): Promise<string> {
-  const uploadDir = path.join(env.GIT_WORKSPACE_DIR, 'public', 'pdf');
-  fs.mkdirSync(uploadDir, { recursive: true });
-
-  const base = slugify(preferredName || '') || slugify(originalBaseName(file)) || 'dokument';
-  const filename = findFreeName(base, '.pdf', '/pdf', [MANAGED_PDF_DIR]);
-
-  fs.writeFileSync(path.join(uploadDir, filename), buffer);
-
-  const pdfUrl = `/pdf/${filename}`;
-  await registerManagedAsset(pdfUrl);
-
-  return pdfUrl;
-}

backend/src/types/index.ts

@@ -1,25 +0,0 @@
-import { FastifyRequest } from 'fastify';
-
-export interface JWTPayload {
-  id: string;
-  giteaId: string;
-  username: string;
-  role: string;
-}
-
-declare module 'fastify' {
-  interface FastifyInstance {
-    authenticate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  }
-
-  interface FastifyRequest {
-    user: JWTPayload;
-  }
-}
-
-declare module '@fastify/jwt' {
-  interface FastifyJWT {
-    payload: JWTPayload;
-    user: JWTPayload;
-  }
-}

backend/tsconfig.json

@@ -1,19 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "node",
-    "esModuleInterop": true,
-    "strict": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true,
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

docker-compose.yml

@@ -1,38 +0,0 @@
-services:
-  frontend:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    environment:
-      - BACKEND_URL=http://proxy:4321
-    depends_on:
-      - backend
-
-  backend:
-    build:
-      context: ./backend
-      dockerfile: Dockerfile
-    env_file:
-      - ./backend/.env.local
-    environment:
-      - NODE_ENV=production
-      - PORT=8080
-      - DATABASE_PATH=/app/data/gallus_cms.db
-      - GIT_WORKSPACE_DIR=/app/workspace
-    volumes:
-      - backend_data:/app/data
-      - backend_workspace:/app/workspace
-
-  proxy:
-    build:
-      context: .
-      dockerfile: Dockerfile.caddy
-    depends_on:
-      - frontend
-      - backend
-    ports:
-      - "4321:80"
-
-volumes:
-  backend_data:
-  backend_workspace:

fly.toml

@@ -9,9 +9,6 @@ kill_timeout = 5
 [env]
   PORT = "3000"
   NODE_ENV = "production"
-  BACKEND_PORT = "8080"
-  DATABASE_PATH = "/app/data/db/gallus_cms.db"
-  GIT_WORKSPACE_DIR = "/app/data/workspace"
 
 [http_service]
   internal_port = 3000
@@ -43,7 +40,3 @@ kill_timeout = 5
   memory = "512MB"
   cpu_kind = "shared"
   cpus = 1
-
-[[mounts]]
-  source = "gallus_data"
-  destination = "/app/data"

package.json

@@ -1,14 +1,19 @@
 {
-  "name": "Gallus Pub Site",
+  "name": "gallus-pub",
   "type": "module",
   "version": "0.0.1",
   "scripts": {
     "dev": "astro dev",
+    "dev:local": "dotenv -e .env.local -- astro dev",
     "build": "astro build",
     "preview": "astro preview",
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^7.2.1"
+    "astro": "^5.12.8",
+    "@astrojs/node": "^9.0.0"
+  },
+  "devDependencies": {
+    "dotenv-cli": "^7.4.1"
   }
 }

pnpm-workspace.yaml

@@ -1,3 +0,0 @@
-onlyBuiltDependencies:
-  - esbuild
-  - sharp