Fully separate auth and eagle deployments (#5370)

- Exclude auth paths from docker_build.yml triggers so eagle builds
  don't trigger when only auth code changes
- Remove `docker compose up -d auth` from docker_build.yml - auth is
  deployed exclusively by auth_build.yml now
- Delete unused deploy/update-env.sh and deploy/env.template

This prevents docker_build.yml from reverting auth to stale images
when it runs after auth_build.yml.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/docker_build.yml

@@ -5,9 +5,15 @@ on:
     branches: [ "main" ]
     paths:
       # Note: C++ changes trigger shardok_arm64_build.yml instead
+      # Note: Auth changes trigger auth_build.yml instead
       - 'src/main/go/**'
+      - '!src/main/go/net/eagle0/authservice/**'
+      - '!src/main/go/net/eagle0/authcli/**'
       - 'src/main/scala/**'
       - 'src/main/protobuf/**'
+      - '!src/main/protobuf/net/eagle0/eagle/api/auth.proto'
+      - '!src/main/protobuf/net/eagle0/eagle/api/admin/**'
+      - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
       - 'MODULE.bazel'
@@ -198,7 +204,7 @@ jobs:
           # Create directory structure on remote
           ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << 'SETUP_DIRS'
           set -e
-          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx /opt/eagle0/deploy
+          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx
           rm -f /opt/eagle0/scripts/bin/warmup
           SETUP_DIRS
 
@@ -207,7 +213,6 @@ jobs:
           scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
           scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
           scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
-          scp -i ~/.ssh/deploy_key deploy/env.template deploy/update-env.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/deploy/
 
       - name: Deploy to production droplet
         run: |
@@ -282,14 +287,12 @@ jobs:
 
           # Deploy Eagle with blue-green (handles eagle, nginx, admin, jfr-sidecar)
           # Note: Shardok runs on Hetzner, deployed separately via shardok_arm64_build.yml
+          # Note: Auth is deployed separately via auth_build.yml - do NOT touch auth here
           chmod +x /opt/eagle0/scripts/*.sh
           [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup
           GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
           /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}"
 
-          # Ensure auth is running
-          docker compose -f docker-compose.prod.yml up -d auth
-
           # Verify
           sleep 10
           docker compose -f docker-compose.prod.yml ps

deploy/env.template

@@ -1,40 +0,0 @@
-# Environment template for production deployment
-# This file defines all env vars used by docker-compose.prod.yml
-# Workflows should update their specific vars without overwriting others
-
-# Container images (managed by respective build workflows)
-# Note: Shardok runs on Hetzner, deployed via shardok_arm64_build.yml
-EAGLE_IMAGE=registry.digitalocean.com/eagle0/eagle-server:latest
-ADMIN_IMAGE=registry.digitalocean.com/eagle0/admin-server:latest
-JFR_SIDECAR_IMAGE=registry.digitalocean.com/eagle0/jfr-sidecar:latest
-AUTH_IMAGE=registry.digitalocean.com/eagle0/auth-server:latest
-
-# OpenAI / LLM
-OPENAI_API_KEY=
-GPT_MODEL_NAME=gpt-4o
-
-# DigitalOcean Spaces (S3-compatible storage)
-EAGLE_ENABLE_S3=false
-DO_SPACES_ACCESS_KEY=
-DO_SPACES_SECRET_KEY=
-
-# JWT authentication
-JWT_PRIVATE_KEY=
-
-# OAuth providers
-DISCORD_CLIENT_ID=
-DISCORD_CLIENT_SECRET=
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-
-# Shardok connection (Hetzner ARM64 server)
-SHARDOK_ADDRESS=
-SHARDOK_AUTH_TOKEN=
-
-# Monitoring
-SENTRY_DSN=
-
-# Email (Fastmail JMAP)
-FASTMAIL_API_TOKEN=
-FASTMAIL_FROM_EMAIL=
-FASTMAIL_FROM_NAME=

deploy/update-env.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Update .env file without losing other variables
-# Usage: ./update-env.sh KEY1=value1 KEY2=value2 ...
-#
-# This script:
-# 1. Creates .env from template if it doesn't exist
-# 2. Updates only the specified KEY=value pairs
-# 3. Preserves all other existing values
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ENV_FILE="${ENV_FILE:-/opt/eagle0/.env}"
-TEMPLATE_FILE="${TEMPLATE_FILE:-$SCRIPT_DIR/env.template}"
-
-# Create .env from template if it doesn't exist
-if [ ! -f "$ENV_FILE" ]; then
-    if [ -f "$TEMPLATE_FILE" ]; then
-        echo "Creating .env from template..."
-        grep -v '^#' "$TEMPLATE_FILE" | grep -v '^$' > "$ENV_FILE"
-    else
-        echo "Creating empty .env..."
-        touch "$ENV_FILE"
-    fi
-    chmod 600 "$ENV_FILE"
-fi
-
-# Process each KEY=VALUE argument
-for arg in "$@"; do
-    # Skip empty args
-    [ -z "$arg" ] && continue
-
-    # Parse KEY=VALUE
-    KEY="${arg%%=*}"
-    VALUE="${arg#*=}"
-
-    # Skip if no key
-    [ -z "$KEY" ] && continue
-
-    # Skip setting empty values (keeps existing value)
-    if [ -z "$VALUE" ]; then
-        echo "Skipping $KEY (empty value)"
-        continue
-    fi
-
-    # Remove existing line for this key and add new one
-    # Use single quotes to avoid issues with special characters in values
-    # (JSON strings, base64 with /, etc.)
-    # Escape any single quotes in the value by replacing ' with '\''
-    ESCAPED_VALUE="${VALUE//\'/\'\\\'\'}"
-
-    if grep -q "^${KEY}=" "$ENV_FILE" 2>/dev/null; then
-        # Key exists, remove old line and add new one (sed with special chars is fragile)
-        grep -v "^${KEY}=" "$ENV_FILE" > "$ENV_FILE.tmp" && mv "$ENV_FILE.tmp" "$ENV_FILE"
-        echo "${KEY}='${ESCAPED_VALUE}'" >> "$ENV_FILE"
-        echo "Updated $KEY"
-    else
-        # Key doesn't exist, add it
-        echo "${KEY}='${ESCAPED_VALUE}'" >> "$ENV_FILE"
-        echo "Added $KEY"
-    fi
-done
-
-chmod 600 "$ENV_FILE"
-echo "Done updating $ENV_FILE"