Deploy to a single target

There is only one server. The site is served from /var/www/mcg on the VPS
at mcg.luxick.de today, and the main domain will be pointed at the same
instance at cutover; local `hugo server` covers development.

Drops the development/production split from the workflow, its
DEPLOY_PATH_DEV / DEPLOY_PATH_PROD secrets and the workflow_dispatch
environment input, leaving a single DEPLOY_PATH. baseURL now comes from
hugo.toml rather than being injected per environment, so it is the one
place to change at cutover.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -5,16 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: 'Deployment target'
-        required: true
-        default: 'development'
-        type: choice
-        options:
-          - development
-          - production
+  workflow_dispatch:      # manual re-deploy of the current main
 
 env:
   HUGO_VERSION: '0.164.0'
@@ -36,35 +27,22 @@ jobs:
           sudo dpkg -i /tmp/hugo.deb
           hugo version
 
-      - name: Resolve target
-        id: target
-        run: |
-          set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] \
-             && [ "${{ inputs.environment }}" = "production" ]; then
-            echo "base_url=https://motorradclub-giebelwald.de/" >> "$GITHUB_OUTPUT"
-            echo "deploy_path=${{ secrets.DEPLOY_PATH_PROD }}" >> "$GITHUB_OUTPUT"
-            echo "name=production" >> "$GITHUB_OUTPUT"
-          else
-            echo "base_url=https://mcg.luxick.de/" >> "$GITHUB_OUTPUT"
-            echo "deploy_path=${{ secrets.DEPLOY_PATH_DEV }}" >> "$GITHUB_OUTPUT"
-            echo "name=development" >> "$GITHUB_OUTPUT"
-          fi
-
+      # baseURL comes from hugo.toml - that is the single place to change when
+      # the site moves to its final domain.
       - name: Build
         run: |
           set -euo pipefail
-          hugo --gc --minify --baseURL "${{ steps.target.outputs.base_url }}"
+          hugo --gc --minify
 
       # Pull requests are built to catch breakage, but never published.
-      - name: Deploy to ${{ steps.target.outputs.name }}
+      - name: Deploy
         if: github.event_name != 'pull_request'
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
           SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
           DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
           DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          DEPLOY_PATH: ${{ steps.target.outputs.deploy_path }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
         run: |
           set -euo pipefail
 

README.md

@@ -2,8 +2,9 @@
 
 Static website of the Motorradclub Giebelwald e.V., built with [Hugo](https://gohugo.io).
 
-- Development: <https://mcg.luxick.de>
-- Production: <https://motorradclub-giebelwald.de>
+Currently served at <https://mcg.luxick.de>. Once the site is signed off, the
+main domain <https://motorradclub-giebelwald.de> will be pointed at the same
+server and the old host retired — see [Changing the domain](#changing-the-domain).
 
 ## Requirements
 
@@ -91,12 +92,15 @@ layouts/                 baseof, home, list, page, termine
 
 ## Deployment
 
-`.gitea/workflows/deploy.yml` builds with Hugo and rsyncs `public/` over SSH.
+`.gitea/workflows/deploy.yml` builds with Hugo and rsyncs `public/` over SSH to
+the VPS webroot.
 
-- Push to `main` → deploys to **mcg.luxick.de**
-- Manual *Run workflow* with `environment: production` → deploys to
-  **motorradclub-giebelwald.de**
-- Pull requests are built but never published
+- Push to `main` → builds and deploys
+- *Run workflow* → manual re-deploy of the current `main`
+- Pull requests are built to catch breakage, but never published
+
+There is one deploy target. For development, run the site locally with
+`hugo server`.
 
 ### Required secrets
 
@@ -105,12 +109,21 @@ Set these in the Gitea repository settings:
 | Secret | Example |
 |---|---|
 | `SSH_PRIVATE_KEY` | Deploy key with write access to the webroot |
-| `SSH_KNOWN_HOSTS` | Output of `ssh-keyscan <host>` |
+| `SSH_KNOWN_HOSTS` | Verified output of `ssh-keyscan <host>` |
 | `DEPLOY_HOST` | `server.example.de` |
 | `DEPLOY_USER` | `www-deploy` |
-| `DEPLOY_PATH_DEV` | `/var/www/mcg-dev` |
-| `DEPLOY_PATH_PROD` | `/var/www/mcg` |
+| `DEPLOY_PATH` | `/var/www/mcg` |
 
-rsync runs with `--delete`, so each `DEPLOY_PATH_*` must point at a directory
-owned solely by this site. The workflow refuses to deploy if the path is unset,
-too shallow, or if the build produced no `index.html`.
+rsync runs with `--delete`, so `DEPLOY_PATH` must point at a directory owned
+solely by this site. The workflow refuses to deploy if the path is unset, too
+shallow, or if the build produced no `index.html`.
+
+### Changing the domain
+
+`baseURL` in `hugo.toml` is the only place the live domain is configured; it
+feeds canonical URLs, `og:url`, the RSS feed and the sitemap. To cut over:
+
+1. Point the DNS record at the VPS.
+2. Add the domain to the nginx `server_name` and reissue the certificate.
+3. Change `baseURL` in `hugo.toml` and push — the deploy rebuilds every
+   absolute URL.

hugo.toml

@@ -1,3 +1,5 @@
+# The live domain. Change this one line when the site moves to
+# https://motorradclub-giebelwald.de/ - it feeds canonical URLs, RSS and sitemap.
 baseURL = 'https://mcg.luxick.de/'
 title = 'Motorradclub Giebelwald e.V.'
 locale = 'de-DE'