Move the gateway to junior.gib: CI deploy, compose copy, renewal script, docs

.gitea/workflows/gateway.yml

@@ -1,11 +1,11 @@
 name: Gateway
 
 # Every push touching the gateway: typecheck and tests. On main, also build the image, push it to
-# the Gitea registry tagged with the commit and `latest`, and ask server-gib to deploy it now.
-# Watchtower's nightly pull there is the fallback when the deploy trigger fails.
+# the Gitea registry tagged with the commit and `latest`, and ask junior.gib (the VPS) to deploy it
+# now. Its nightly update-containers timer is the fallback when the deploy trigger fails.
 #
 # Uses the user-level secrets REGISTRY_USER and REGISTRY_PASSWORD, and the repo secret
-# DEPLOY_SSH_KEY_HOME_B64, a base64 encoded key that server-gib only accepts for
+# DEPLOY_SSH_KEY_VPS_B64, a base64 encoded key that junior.gib only accepts for
 # ~/Server/ci-deploy.sh.
 
 on:
@@ -79,10 +79,11 @@ jobs:
           docker push "$IMAGE:latest"
 
       - name: Deploy
-        # The secret is the private key base64 encoded on one line. The runner prints each step's
+        # 192.168.2.2 is junior's WireGuard address, reachable from every runner. The secret is the
+        # private key base64 encoded on one line. The runner prints each step's
         # env, and Gitea only masks a secret it can match in full, which a multi-line key defeats.
         env:
-          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_HOME_B64 }}
+          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_VPS_B64 }}
         run: |
           install -m600 /dev/null "$HOME/.deploy_key"
           printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > "$HOME/.deploy_key"
@@ -90,6 +91,6 @@ jobs:
               -o BatchMode=yes \
               -o StrictHostKeyChecking=accept-new \
               -o ConnectTimeout=15 \
-              [email protected].1.2 wristcode \
-            || echo "::warning::deploy trigger failed; Watchtower will deploy at 04:00 instead"
+              [email protected].2.2 wristcode \
+            || echo "::warning::deploy trigger failed; the nightly update timer will deploy instead"
           rm -f "$HOME/.deploy_key"