Use prepare.py in CI instead of manual settings.env creation

ctrl.sh now requires both settings.yaml and settings.env, but CI only
created settings.env. Replace the manual file creation with a
./prepare.py call that generates all required configuration files.

Also change the default TLS mode from "internal" to "off" so that
prepare.py produces valid config without requiring a domain.

Author: Nils Bars

.github/workflows/ci.yml

@@ -94,25 +94,11 @@ jobs:
       - name: Set up Python
         run: uv python install ${{ env.PYTHON_VERSION }}
 
-      - name: Install Python dependencies for ctrl.sh
-        run: pip install jinja2
+      - name: Install Python dependencies for prepare.py
+        run: pip install jinja2 pyyaml
 
-      - name: Create settings.env
-        run: |
-          DOCKER_GID=$(getent group docker | cut -d: -f3)
-          cat > settings.env << EOF
-          DEBUG=1
-          MAINTENANCE_ENABLED=0
-          ADMIN_PASSWORD=TestAdmin123!
-          DOCKER_GROUP_ID=${DOCKER_GID}
-          SSH_HOST_PORT=2222
-          HTTP_HOST_PORT=8000
-          SECRET_KEY=TestSecretKeyForCI12345
-          SSH_TO_WEB_KEY=TestSSHToWebKeyForCI
-          POSTGRES_PASSWORD=TestPostgresPassword123!
-          EOF
-          # Remove leading whitespace from each line
-          sed -i 's/^[[:space:]]*//' settings.env
+      - name: Generate configuration
+        run: ./prepare.py
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

README.md

@@ -20,7 +20,7 @@ To inspect or edit `settings.yaml` before the first build, run `./prepare.py` ma
 | `ports` | `ssh_host_port` | 2222 | SSH reverse-proxy listen port |
 | | `http_host_port` | 8080 | HTTP port (plain or redirect) |
 | | `https_host_port` | 8443 | HTTPS port |
-| `tls` | `mode` | `internal` | `off` (plain HTTP), `internal` (self-signed), or `acme` (Let's Encrypt) |
+| `tls` | `mode` | `off` | `off` (plain HTTP), `internal` (self-signed), or `acme` (Let's Encrypt) |
 | | `domain` | — | Required for `internal` and `acme` modes |
 | | `redirect_http_to_https` | `false` | Redirect HTTP port to HTTPS (`internal` and `acme` modes only) |
 | `paths` | `data` | `./data` | Persistent data directory on the host |

prepare.py

@@ -56,7 +56,7 @@ def build_default_settings() -> Dict[str, Any]:
         },
         "tls": {
             # off = plain HTTP, internal = self-signed, acme = Let's Encrypt
-            "mode": "internal",
+            "mode": "off",
             "domain": None,
             # Redirect HTTP to HTTPS (only applies to internal and acme modes).
             "redirect_http_to_https": False,