chore(deps): update gitea actions

Runner im Gitea-Pool sind nicht garantiert amd64 (z. B. arm64 unter dem
Label "ubuntu-latest"). Die Installations-Schritte luden bisher hart
codiert amd64-Binaries, was auf arm64-Runnern mit "Exec format error"
fehlschlug. Erkennt jetzt die Architektur per uname -m und wählt das
passende Release-Asset; Cache-Keys enthalten die Architektur ebenfalls,
damit kein arm64-Runner einen amd64-Cache-Treffer bekommt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.cargo/config.toml

@@ -0,0 +1,15 @@
+[registry]
+default = "gitea"
+
+[registries.gitea]
+index = "sparse+https://gitea.creative-dragonslayer.de/api/packages/Rust-Crates/cargo/" # Sparse index
+# index = "https://gitea.creative-dragonslayer.de/Rust-Crates/_cargo-index.git" # Git
+
+[net]
+git-fetch-with-cli = true
+
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+
+[target.i686-unknown-linux-gnu]
+linker = "i686-linux-gnu-gcc"

.gitea/workflows/code-quality.yaml

@@ -0,0 +1,52 @@
+name: Code Quality (Auto-Format & Clippy-Fix)
+
+on:
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+
+jobs:
+  fix:
+    name: Formatierung & Clippy automatisch beheben
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ gitea.ref_name || github.ref_name }}
+          token: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          components: clippy, rustfmt
+          cache: false
+
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Formatierung automatisch beheben
+        run: cargo fmt
+
+      - name: Clippy-Fixes automatisch anwenden
+        run: cargo clippy --fix --allow-dirty --allow-staged --all-targets
+
+      - name: Änderungen committen & pushen
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            git config user.name "Gitea-Bot"
+            git config user.email "no-reply@creativedragonslayer.de"
+            git add -A
+            git commit -m "Style: Automatische Formatierung & Clippy-Fixes"
+            git push origin HEAD:${{ gitea.ref_name || github.ref_name }}
+          else
+            echo "Keine Formatierungs- oder Clippy-Änderungen."
+          fi

.gitea/workflows/main.yaml

@@ -0,0 +1,252 @@
+name: Main Release & Publish
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Code-Änderungen
+    runs-on: ubuntu-latest
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Prüfe auf Änderungen am Programmcode
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'scripts/**'
+              - '.cargo/**'
+              - '.gitea/workflows/main.yaml'
+
+  release-and-publish:
+    name: Build, Publish Packages (Stable) & Create Release
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
+
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
+        run: |
+          mkdir -p ~/.cargo/bin
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/cargo-binstall
+            ~/.cargo/bin/cargo-deb
+            ~/.cargo/bin/cargo-generate-rpm
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
+
+      - name: Run Tests
+        run: |
+          cargo test
+
+      - name: Build Release Binaries
+        run: |
+          cargo build --release --target x86_64-unknown-linux-gnu
+          cargo build --release --target aarch64-unknown-linux-gnu
+          cargo build --release --target i686-unknown-linux-gnu
+
+      - name: Determine Build Number
+        id: build_num
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          BUILD_NUM=$(python3 scripts/get-build-number.py)
+          echo "build_number=${BUILD_NUM}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUM}" >> $GITHUB_ENV
+          echo "Ermittelte Build-Nummer: ${BUILD_NUM}"
+
+      - name: Build Debian Packages (.deb)
+        run: |
+          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target i686-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+
+      - name: Build Fedora / RPM Packages (.rpm)
+        run: |
+          mkdir -p target/generate-rpm
+          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target i686-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+
+      - name: Build Arch Linux Packages (.pkg.tar.zst)
+        run: |
+          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target i686-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+
+      - name: Publish Packages to Gitea Package Registry
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          echo "Veröffentliche Debian-Paket (Distribution: stable, Component: main)..."
+          for deb in target/debian/*.deb; do
+            [ -f "$deb" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$deb" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/debian/pool/stable/main/upload"
+          done
+
+          echo "Veröffentliche Fedora/RPM-Paket (Gruppe: stable)..."
+          for rpm in target/generate-rpm/*.rpm; do
+            [ -f "$rpm" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$rpm" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/rpm/stable/upload"
+          done
+
+          echo "Veröffentliche Arch Linux-Paket (Repository: stable)..."
+          for pkg in target/arch/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$pkg" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/arch/stable"
+          done
+
+      - name: Create Gitea Release and Upload Assets
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_NAME: ${{ gitea.repository_name || github.event.repository.name }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)"
+          TAG_NAME="v${VERSION}"
+          RELEASE_TITLE="Release ${TAG_NAME}"
+          RELEASE_NOTES="Automatisches Release für ${REPO_NAME} ${VERSION}."
+
+          echo "Erstelle oder hole Release für Tag ${TAG_NAME} in ${REPO}..."
+
+          GET_RESP=$(curl -s -w "\n%{http_code}" \
+            -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${TAG_NAME}")
+          HTTP_CODE=$(echo "$GET_RESP" | tail -n1)
+          BODY=$(echo "$GET_RESP" | sed '$d')
+
+          RELEASE_ID=""
+          if [ "$HTTP_CODE" -eq 200 ]; then
+            RELEASE_ID=$(echo "$BODY" | jq -r '.id // empty' 2>/dev/null || echo "$BODY" | grep -o '"id":[0-9]*' | head -n1 | cut -d: -f2)
+            echo "Bestehendes Release gefunden (ID: ${RELEASE_ID})."
+          else
+            echo "Erstelle neues Release ${TAG_NAME}..."
+            CREATE_PAYLOAD=$(cat <<EOF
+          {
+            "tag_name": "${TAG_NAME}",
+            "target_commitish": "main",
+            "name": "${RELEASE_TITLE}",
+            "body": "${RELEASE_NOTES}",
+            "draft": false,
+            "prerelease": false
+          }
+          EOF
+          )
+            CREATE_RESP=$(curl -f -s -S -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$CREATE_PAYLOAD" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases")
+            RELEASE_ID=$(echo "$CREATE_RESP" | jq -r '.id // empty' 2>/dev/null || echo "$CREATE_RESP" | grep -o '"id":[0-9]*' | head -n1 | cut -d: -f2)
+            echo "Neues Release erstellt (ID: ${RELEASE_ID})."
+          fi
+
+          if [ -z "$RELEASE_ID" ]; then
+            echo "Fehler: Release-ID konnte nicht ermittelt werden!"
+            exit 1
+          fi
+
+          EXISTING_ASSETS_JSON=$(curl -s \
+            -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" || echo "[]")
+
+          for file in target/debian/*.deb target/generate-rpm/*.rpm target/arch/*.pkg.tar.zst; do
+            [ -f "$file" ] || continue
+            filename="$(basename "$file")"
+            echo "Lade Release-Asset hoch: $filename"
+
+            ASSET_ID=$(echo "$EXISTING_ASSETS_JSON" | jq -r --arg name "$filename" '.[]? | select(.name == $name) | .id' 2>/dev/null | head -n1 || true)
+            if [ -n "$ASSET_ID" ] && [ "$ASSET_ID" != "null" ]; then
+              echo "Lösche altes Asset mit ID ${ASSET_ID}..."
+              curl -s -X DELETE \
+                -H "Authorization: token ${TOKEN}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${ASSET_ID}" || true
+            fi
+
+            curl -f -s -S -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -F "attachment=@${file}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${filename}"
+            echo "Asset ${filename} erfolgreich hochgeladen."
+          done

.gitea/workflows/nightly-pr.yaml

@@ -0,0 +1,91 @@
+name: Nightly Auto-Merge (Dev → Nightly)
+
+on:
+  schedule:
+    # Gitea Actions interpretiert 'schedule'-Cron standardmaessig in der lokalen
+    # Zeitzone des Gitea-Servers (anders als GitHub Actions, das immer UTC nutzt).
+    # Das CRON_TZ-Praefix ist eine Gitea-Erweiterung und legt die Zeitzone explizit
+    # und DST-sicher fest, unabhaengig von der Server-Konfiguration.
+    - cron: "CRON_TZ=Europe/Berlin 0 9 * * *"
+  workflow_dispatch:
+
+jobs:
+  merge-dev-into-nightly:
+    name: Erstelle & merge automatisch PR von dev nach nightly
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+
+      - name: Stelle sicher, dass der nightly-Branch existiert
+        run: |
+          git fetch origin dev
+          if git ls-remote --exit-code --heads origin nightly > /dev/null 2>&1; then
+            echo "nightly-Branch existiert bereits."
+          else
+            echo "nightly-Branch existiert noch nicht, erstelle ihn initial von dev..."
+            git push origin origin/dev:refs/heads/nightly
+          fi
+
+      - name: Prüfe auf Unterschiede zwischen dev und nightly
+        id: diff
+        run: |
+          git fetch origin nightly
+          if git diff --quiet origin/nightly origin/dev; then
+            echo "Keine Unterschiede zwischen dev und nightly, überspringe."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prüfe auf bereits offenen PR nach nightly
+        id: check_pr
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          OPEN_PRS=$(curl -s -H "Authorization: token ${TOKEN}" "${GITEA_URL}/api/v1/repos/${REPO}/pulls?state=open&limit=50")
+          PR_NUMBER=$(echo "$OPEN_PRS" | jq -r '[.[] | select(.base.ref == "nightly" and .head.ref == "dev")][0].number // empty')
+          echo "Bereits offener dev→nightly PR: ${PR_NUMBER:-keiner}"
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Erstelle PR (dev -> nightly)
+        id: create_pr
+        if: steps.diff.outputs.has_changes == 'true' && steps.check_pr.outputs.pr_number == ''
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          DATE="$(date -u +%Y-%m-%d)"
+          PAYLOAD=$(jq -n --arg title "Nightly-Build: Merge dev in nightly (${DATE})" --arg head "dev" --arg base "nightly" \
+            '{title: $title, head: $head, base: $base}')
+          RESP=$(curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls")
+          PR_NUMBER=$(echo "$RESP" | jq -r '.number')
+          echo "PR #${PR_NUMBER} erstellt."
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Merge PR automatisch
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+          PR_NUMBER: ${{ steps.create_pr.outputs.pr_number || steps.check_pr.outputs.pr_number }}
+        run: |
+          echo "Merge PR #${PR_NUMBER} automatisch (dev -> nightly)..."
+          curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do": "merge"}' \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/merge"
+          echo "PR #${PR_NUMBER} erfolgreich gemerged."

.gitea/workflows/nightly.yaml

@@ -0,0 +1,171 @@
+name: Nightly Build & Publish
+
+on:
+  push:
+    branches:
+      - nightly
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Code-Änderungen
+    runs-on: ubuntu-latest
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Prüfe auf Änderungen am Programmcode
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'scripts/**'
+              - '.cargo/**'
+              - '.gitea/workflows/nightly.yaml'
+
+  build-and-publish:
+    name: Build & Publish Packages (Nightly)
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
+
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
+        run: |
+          mkdir -p ~/.cargo/bin
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/cargo-binstall
+            ~/.cargo/bin/cargo-deb
+            ~/.cargo/bin/cargo-generate-rpm
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
+
+      - name: Run Tests
+        run: |
+          cargo test
+
+      - name: Build Release Binaries
+        run: |
+          cargo build --release --target x86_64-unknown-linux-gnu
+          cargo build --release --target aarch64-unknown-linux-gnu
+          cargo build --release --target i686-unknown-linux-gnu
+
+      - name: Determine Build Number
+        id: build_num
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          BUILD_NUM=$(python3 scripts/get-build-number.py)
+          echo "build_number=${BUILD_NUM}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUM}" >> $GITHUB_ENV
+          echo "Ermittelte Build-Nummer: ${BUILD_NUM}"
+
+      - name: Build Debian Packages (.deb)
+        run: |
+          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target i686-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+
+      - name: Build Fedora / RPM Packages (.rpm)
+        run: |
+          mkdir -p target/generate-rpm
+          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target i686-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+
+      - name: Build Arch Linux Packages (.pkg.tar.zst)
+        run: |
+          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target i686-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+
+      - name: Publish Packages to Gitea Package Registry
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          echo "Veröffentliche Debian-Paket (Distribution: nightly, Component: main)..."
+          for deb in target/debian/*.deb; do
+            [ -f "$deb" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$deb" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/debian/pool/nightly/main/upload"
+          done
+
+          echo "Veröffentliche Fedora/RPM-Paket (Gruppe: nightly)..."
+          for rpm in target/generate-rpm/*.rpm; do
+            [ -f "$rpm" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$rpm" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/rpm/nightly/upload"
+          done
+
+          echo "Veröffentliche Arch Linux-Paket (Repository: nightly)..."
+          for pkg in target/arch/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$pkg" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/arch/nightly"
+          done

.gitea/workflows/renovate.yaml

@@ -0,0 +1,27 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 * * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    name: Dependency-Updates prüfen & Pull Requests erstellen
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:44.108.2
+    steps:
+      - name: Renovate ausführen
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ gitea.server_url || github.server_url }}/api/v1/
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ gitea.repository || github.repository }}
+          RENOVATE_AUTODISCOVER: "false"
+          RENOVATE_ALLOW_CUSTOM_CRATE_REGISTRIES: "true"
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@creativedragonslayer.de>"
+          RENOVATE_HOST_RULES: >-
+            [{"hostType":"cargo","matchHost":"${{ gitea.server_url || github.server_url }}","token":"${{ secrets.RENOVATE_TOKEN }}"}]
+          GITHUB_COM_TOKEN: ${{ secrets.GH_RENOVATE_TOKEN }}
+          LOG_LEVEL: info

.gitea/workflows/security-scan.yaml

@@ -0,0 +1,108 @@
+name: Security Scans
+
+on:
+  push:
+    branches:
+      - main
+      - testing
+      - dev
+  pull_request:
+  schedule:
+    - cron: "CRON_TZ=Europe/Berlin 0 5 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    name: Trivy & OSV-Scanner
+    runs-on: ubuntu-latest
+    env:
+      TRIVY_VERSION: "0.74.0"
+      OSV_SCANNER_VERSION: "2.6.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Architektur des Runners ermitteln
+        id: detect-arch
+        run: |
+          case "$(uname -m)" in
+            x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;;
+            aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;;
+            *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;;
+          esac
+
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Trivy-Binary
+        id: cache-trivy
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trivy
+          key: trivy-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRIVY_VERSION }}
+
+      - name: Install Trivy
+        if: steps.cache-trivy.outputs.cache-hit != 'true'
+        run: |
+          case "${{ steps.detect-arch.outputs.arch }}" in
+            amd64) TRIVY_ARCH="64bit" ;;
+            arm64) TRIVY_ARCH="ARM64" ;;
+          esac
+          curl -fsSL -o trivy.tar.gz \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz"
+          tar -xzf trivy.tar.gz trivy
+          chmod +x trivy
+          mv trivy "$HOME/.local/bin/trivy"
+          rm -f trivy.tar.gz
+
+      - name: Ermittle Cache-Datum für Trivy-DB
+        run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV"
+
+      - name: Cache Trivy-Schwachstellen-Datenbank
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
+      - name: Run Trivy Scanner
+        run: |
+          trivy fs \
+            --scanners vuln,secret,misconfig \
+            --severity CRITICAL,HIGH \
+            --format json \
+            --output trivy-results.json \
+            --exit-code 0 \
+            .
+
+      - name: Cache OSV-Scanner-Binary
+        id: cache-osv-scanner
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/osv-scanner
+          key: osv-scanner-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.OSV_SCANNER_VERSION }}
+
+      - name: Install OSV-Scanner
+        if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_${{ steps.detect-arch.outputs.arch }}"
+          chmod +x "$HOME/.local/bin/osv-scanner"
+
+      - name: Run OSV-Scanner
+        run: |
+          set +e
+          osv-scanner scan source --recursive --format json --output-file osv-results.json .
+          echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+        run: |
+          python3 scripts/report-security-issue.py trivy-results.json osv-results.json

.gitea/workflows/testing-to-main-pr.yaml

@@ -0,0 +1,111 @@
+name: Auto-PR (Testing → Main)
+
+on:
+  push:
+    branches:
+      - testing
+
+jobs:
+  create-pr:
+    name: Erstelle automatisch PR von testing nach main
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Prüfe auf bereits offenen PR nach main
+        id: check_pr
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          OPEN_PRS=$(curl -s -H "Authorization: token ${TOKEN}" "${GITEA_URL}/api/v1/repos/${REPO}/pulls?state=open&limit=50")
+          EXISTS=$(echo "$OPEN_PRS" | jq -r '[.[] | select(.base.ref == "main" and .head.ref == "testing")] | length')
+          echo "Bereits offene testing→main PRs: ${EXISTS}"
+          echo "exists=${EXISTS}" >> "$GITHUB_OUTPUT"
+
+      - name: Ermittle Versionen auf main & testing
+        id: versions
+        if: steps.check_pr.outputs.exists == '0'
+        run: |
+          git fetch origin main
+          MAIN_VERSION="$(git show origin/main:Cargo.toml | sed -n 's/^version = "\(.*\)"/\1/p' | head -n1)"
+          TESTING_VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)"
+          echo "Version auf main: ${MAIN_VERSION} / Version auf testing: ${TESTING_VERSION}"
+          echo "main_version=${MAIN_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "testing_version=${TESTING_VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Ermittle geänderte Kategorien (main...testing)
+        id: categories
+        if: steps.check_pr.outputs.exists == '0' && steps.versions.outputs.main_version == steps.versions.outputs.testing_version
+        run: |
+          CHANGED_FILES="$(git diff --name-only origin/main...HEAD)"
+          echo "Geänderte Dateien main...testing:"
+          echo "$CHANGED_FILES"
+
+          WORKFLOWS="false"
+          CONFIG="false"
+          DOCS="false"
+
+          if echo "$CHANGED_FILES" | grep -q '^\.gitea/workflows/'; then
+            WORKFLOWS="true"
+          fi
+          if echo "$CHANGED_FILES" | grep -qE '^(renovate\.json|qodana\.yaml|Cargo\.toml|Cargo\.lock|\.cargo/)'; then
+            CONFIG="true"
+          fi
+          if echo "$CHANGED_FILES" | grep -qE '(^|/)[^/]+\.md$|^LICENSE$'; then
+            DOCS="true"
+          fi
+
+          echo "workflows=${WORKFLOWS}" >> "$GITHUB_OUTPUT"
+          echo "config=${CONFIG}" >> "$GITHUB_OUTPUT"
+          echo "docs=${DOCS}" >> "$GITHUB_OUTPUT"
+
+      - name: Bestimme PR-Titel
+        id: title
+        if: steps.check_pr.outputs.exists == '0'
+        run: |
+          if [ "${{ steps.versions.outputs.main_version }}" != "${{ steps.versions.outputs.testing_version }}" ]; then
+            TITLE="Merge testing in main: Release ${{ steps.versions.outputs.testing_version }}"
+          else
+            PARTS=()
+            [ "${{ steps.categories.outputs.workflows }}" = "true" ] && PARTS+=("Workflows")
+            [ "${{ steps.categories.outputs.config }}" = "true" ] && PARTS+=("Konfigurationen")
+            [ "${{ steps.categories.outputs.docs }}" = "true" ] && PARTS+=("Dokumentation")
+
+            if [ ${#PARTS[@]} -eq 0 ]; then
+              TITLE="Merge testing in main"
+            else
+              JOINED=""
+              for PART in "${PARTS[@]}"; do
+                if [ -z "$JOINED" ]; then
+                  JOINED="$PART"
+                else
+                  JOINED="${JOINED} & ${PART}"
+                fi
+              done
+              TITLE="Merge testing in main: ${JOINED} aktualisiert"
+            fi
+          fi
+          echo "Ermittelter PR-Titel: ${TITLE}"
+          echo "title=${TITLE}" >> "$GITHUB_OUTPUT"
+
+      - name: Erstelle PR (testing -> main)
+        if: steps.check_pr.outputs.exists == '0'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+          TITLE: ${{ steps.title.outputs.title }}
+        run: |
+          PAYLOAD=$(jq -n --arg title "$TITLE" --arg head "testing" --arg base "main" \
+            '{title: $title, head: $head, base: $base}')
+          curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls"
+          echo "PR erstellt: ${TITLE}"

.gitea/workflows/testing.yaml

@@ -0,0 +1,252 @@
+name: Testing Build, Publish & Preview Release
+
+on:
+  push:
+    branches:
+      - testing
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Code-Änderungen
+    runs-on: ubuntu-latest
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Prüfe auf Änderungen am Programmcode
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'scripts/**'
+              - '.cargo/**'
+              - '.gitea/workflows/testing.yaml'
+
+  build-and-publish:
+    name: Build, Publish Packages (Testing) & Create Preview Release
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
+
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
+        run: |
+          mkdir -p ~/.cargo/bin
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/cargo-binstall
+            ~/.cargo/bin/cargo-deb
+            ~/.cargo/bin/cargo-generate-rpm
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
+
+      - name: Run Tests
+        run: |
+          cargo test
+
+      - name: Build Release Binaries
+        run: |
+          cargo build --release --target x86_64-unknown-linux-gnu
+          cargo build --release --target aarch64-unknown-linux-gnu
+          cargo build --release --target i686-unknown-linux-gnu
+
+      - name: Determine Build Number
+        id: build_num
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          BUILD_NUM=$(python3 scripts/get-build-number.py)
+          echo "build_number=${BUILD_NUM}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUM}" >> $GITHUB_ENV
+          echo "Ermittelte Build-Nummer: ${BUILD_NUM}"
+
+      - name: Build Debian Packages (.deb)
+        run: |
+          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target i686-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+
+      - name: Build Fedora / RPM Packages (.rpm)
+        run: |
+          mkdir -p target/generate-rpm
+          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target i686-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+
+      - name: Build Arch Linux Packages (.pkg.tar.zst)
+        run: |
+          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target i686-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+
+      - name: Publish Packages to Gitea Package Registry
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          echo "Veröffentliche Debian-Paket (Distribution: testing, Component: main)..."
+          for deb in target/debian/*.deb; do
+            [ -f "$deb" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$deb" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/debian/pool/testing/main/upload"
+          done
+
+          echo "Veröffentliche Fedora/RPM-Paket (Gruppe: testing)..."
+          for rpm in target/generate-rpm/*.rpm; do
+            [ -f "$rpm" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$rpm" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/rpm/testing/upload"
+          done
+
+          echo "Veröffentliche Arch Linux-Paket (Repository: testing)..."
+          for pkg in target/arch/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$pkg" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/arch/testing"
+          done
+
+      - name: Create Gitea Pre-Release and Upload Assets
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_NAME: ${{ gitea.repository_name || github.event.repository.name }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)"
+          TAG_NAME="v${VERSION}-preview"
+          RELEASE_TITLE="Preview Release ${TAG_NAME}"
+          RELEASE_NOTES="Automatisches Preview-Release für ${REPO_NAME} ${VERSION} (Branch: Testing)."
+
+          echo "Erstelle oder hole Preview-Release für Tag ${TAG_NAME} in ${REPO}..."
+
+          GET_RESP=$(curl -s -w "\n%{http_code}" \
+            -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${TAG_NAME}")
+          HTTP_CODE=$(echo "$GET_RESP" | tail -n1)
+          BODY=$(echo "$GET_RESP" | sed '$d')
+
+          RELEASE_ID=""
+          if [ "$HTTP_CODE" -eq 200 ]; then
+            RELEASE_ID=$(echo "$BODY" | jq -r '.id // empty' 2>/dev/null || echo "$BODY" | grep -o '"id":[0-9]*' | head -n1 | cut -d: -f2)
+            echo "Bestehendes Release gefunden (ID: ${RELEASE_ID})."
+          else
+            echo "Erstelle neues Preview-Release ${TAG_NAME}..."
+            CREATE_PAYLOAD=$(cat <<EOF
+          {
+            "tag_name": "${TAG_NAME}",
+            "target_commitish": "testing",
+            "name": "${RELEASE_TITLE}",
+            "body": "${RELEASE_NOTES}",
+            "draft": false,
+            "prerelease": true
+          }
+          EOF
+          )
+            CREATE_RESP=$(curl -f -s -S -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$CREATE_PAYLOAD" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases")
+            RELEASE_ID=$(echo "$CREATE_RESP" | jq -r '.id // empty' 2>/dev/null || echo "$CREATE_RESP" | grep -o '"id":[0-9]*' | head -n1 | cut -d: -f2)
+            echo "Neues Preview-Release erstellt (ID: ${RELEASE_ID})."
+          fi
+
+          if [ -z "$RELEASE_ID" ]; then
+            echo "Fehler: Release-ID konnte nicht ermittelt werden!"
+            exit 1
+          fi
+
+          EXISTING_ASSETS_JSON=$(curl -s \
+            -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" || echo "[]")
+
+          for file in target/debian/*.deb target/generate-rpm/*.rpm target/arch/*.pkg.tar.zst; do
+            [ -f "$file" ] || continue
+            filename="$(basename "$file")"
+            echo "Lade Release-Asset hoch: $filename"
+
+            ASSET_ID=$(echo "$EXISTING_ASSETS_JSON" | jq -r --arg name "$filename" '.[]? | select(.name == $name) | .id' 2>/dev/null | head -n1 || true)
+            if [ -n "$ASSET_ID" ] && [ "$ASSET_ID" != "null" ]; then
+              echo "Lösche altes Asset mit ID ${ASSET_ID}..."
+              curl -s -X DELETE \
+                -H "Authorization: token ${TOKEN}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${ASSET_ID}" || true
+            fi
+
+            curl -f -s -S -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -F "attachment=@${file}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${filename}"
+            echo "Asset ${filename} erfolgreich hochgeladen."
+          done

.gitea/workflows/trufflehog-scan.yaml

@@ -0,0 +1,68 @@
+name: TruffleHog Secret Scan
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "CRON_TZ=Europe/Berlin 0 6 * * 1"
+  workflow_dispatch:
+
+jobs:
+  trufflehog-scan:
+    name: TruffleHog
+    runs-on: ubuntu-latest
+    env:
+      TRUFFLEHOG_VERSION: "3.97.6"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Architektur des Runners ermitteln
+        id: detect-arch
+        run: |
+          case "$(uname -m)" in
+            x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;;
+            aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;;
+            *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;;
+          esac
+
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache TruffleHog-Binary
+        id: cache-trufflehog
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trufflehog
+          key: trufflehog-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRUFFLEHOG_VERSION }}
+
+      - name: Install TruffleHog
+        if: steps.cache-trufflehog.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL -o trufflehog.tar.gz \
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_${{ steps.detect-arch.outputs.arch }}.tar.gz"
+          tar -xzf trufflehog.tar.gz trufflehog
+          chmod +x trufflehog
+          mv trufflehog "$HOME/.local/bin/trufflehog"
+          rm trufflehog.tar.gz
+
+      - name: Run TruffleHog Scanner
+        run: |
+          set +e
+          trufflehog git file://. --results=verified,unknown --fail --json > trufflehog-results.json
+          echo "TRUFFLEHOG_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+          ISSUE_TITLE: "Security-Scan: TruffleHog Secrets"
+          ISSUE_LABEL: "security-scan-trufflehog"
+        run: |
+          python3 scripts/report-security-issue.py "" "" trufflehog-results.json

.gitea/workflows/unit-tests.yaml

@@ -0,0 +1,37 @@
+name: Unit-Tests
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - testing
+      - dev
+
+jobs:
+  test:
+    name: Unit-Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run Tests
+        run: cargo test

.gitea/workflows/version-bump.yaml

@@ -0,0 +1,84 @@
+name: Auto Patch-Version-Bump (Dev → Testing PR)
+
+on:
+  pull_request:
+    types: [opened]
+    branches:
+      - testing
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Änderungen im PR
+    runs-on: ubuntu-latest
+    if: ${{ (gitea.head_ref || github.head_ref) == 'dev' }}
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Dev-Branch (PR-Head)
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ gitea.head_ref || github.head_ref }}
+          fetch-depth: 0
+
+      - name: Prüfe auf Änderungen an Cargo.toml, Cargo.lock oder src/
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          base: ${{ gitea.base_ref || github.base_ref }}
+          filters: |
+            code:
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'src/**'
+
+  bump-version:
+    name: Patch-Version erhöhen & auf Dev pushen
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Dev-Branch (PR-Head)
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ gitea.head_ref || github.head_ref }}
+          fetch-depth: 0
+          token: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+
+      - name: Ermittle Cargo-Version auf testing & dev
+        id: versions
+        run: |
+          git fetch origin testing --depth=1
+          TESTING_VERSION="$(git show origin/testing:Cargo.toml | sed -n 's/^version = "\(.*\)"/\1/p' | head -n1)"
+          DEV_VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)"
+          echo "Version auf testing: ${TESTING_VERSION} / Version auf dev: ${DEV_VERSION}"
+          echo "testing_version=${TESTING_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "dev_version=${DEV_VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Patch-Version um 1 erhöhen (Cargo.toml & Cargo.lock)
+        if: steps.versions.outputs.testing_version == steps.versions.outputs.dev_version
+        run: |
+          VERSION="${{ steps.versions.outputs.dev_version }}"
+          MAJOR="$(echo "$VERSION" | cut -d. -f1)"
+          MINOR="$(echo "$VERSION" | cut -d. -f2)"
+          PATCH="$(echo "$VERSION" | cut -d. -f3)"
+          NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+          echo "Erhöhe Version: ${VERSION} -> ${NEW_VERSION}"
+
+          sed -i "0,/^version = \"${VERSION}\"/s//version = \"${NEW_VERSION}\"/" Cargo.toml
+
+          PACKAGE_NAME="$(sed -n 's/^name = "\(.*\)"/\1/p' Cargo.toml | head -n1)"
+          awk -v new="$NEW_VERSION" -v pkg="$PACKAGE_NAME" '
+            found_name && /^version = "/ {
+              print "version = \"" new "\""
+              found_name = 0
+              next
+            }
+            $0 == "name = \"" pkg "\"" { found_name = 1 }
+            { print }
+          ' Cargo.lock > Cargo.lock.tmp && mv Cargo.lock.tmp Cargo.lock
+
+          git config user.name "Gitea-Bot"
+          git config user.email "no-reply@creativedragonslayer.de"
+          git add Cargo.toml Cargo.lock
+          git commit -m "Chore: Erhöht Patch-Version auf ${NEW_VERSION} für Promotion nach testing"
+          git push origin HEAD:${{ gitea.head_ref || github.head_ref }}

.gitignore

@@ -109,3 +109,4 @@ fabric.properties
 # Built Visual Studio Code Extensions
 *.vsix
 
+.junie/plans

.idea/.gitignore

@@ -0,0 +1,10 @@
+# Default ignored files
+/shelf/
+/workspace.xml
+# Editor-based HTTP Client requests
+/httpRequests/
+# Ignored default folder with query files
+/queries/
+# Datasource local storage ignored files
+/dataSources/
+/dataSources.local.xml

.idea/DockerUpdater.iml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="EMPTY_MODULE" version="4">
+  <component name="NewModuleRootManager">
+    <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" />
+      <excludeFolder url="file://$MODULE_DIR$/target" />
+    </content>
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

.idea/jsonSchemas.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="JsonSchemaMappingsProjectConfiguration">
+    <state>
+      <map>
+        <entry key="GitHub Workflow">
+          <value>
+            <SchemaInfo>
+              <option name="name" value="GitHub Workflow" />
+              <option name="relativePathToSchema" value="https://www.schemastore.org/github-workflow.json" />
+              <option name="applicationDefined" value="true" />
+              <option name="patterns">
+                <list>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/testing.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/main.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/renovate.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/security-scan.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/trufflehog-scan.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/unit-tests.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/code-quality.yaml" />
+                  </Item>
+                </list>
+              </option>
+            </SchemaInfo>
+          </value>
+        </entry>
+      </map>
+    </state>
+  </component>
+</project>

.idea/misc.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="GHAISettings">{}</component>
+</project>

.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/DockerUpdater.iml" filepath="$PROJECT_DIR$/.idea/DockerUpdater.iml" />
+    </modules>
+  </component>
+</project>

.idea/rust.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="RsVcsConfiguration">
+    <option name="rustFmt" value="true" />
+  </component>
+</project>

.idea/vcs.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>

AGENTS.md

@@ -0,0 +1,126 @@
+# AGENTS.md — Entwickler- und Agenten-Dokumentation für DockerUpdate
+
+Diese Datei dient als Leitfaden und Kontextdokumentation für autonome Agenten und Entwickler, die an der Codebasis von
+`docker-update` arbeiten.
+
+---
+
+## 1. Projektübersicht
+
+`docker-update` ist ein schlankes CLI-Werkzeug für **Linux-Server** (Rust 2024 Edition). Es durchsucht Verzeichnisse mit
+Docker-Compose-Dateien (standardmäßig `/var/apps`), prüft definierte Services mit `:latest`-Images auf neuere Versionen,
+lädt diese herunter, startet betroffene Services neu und bereinigt ungenutzte Zwischen-Images.
+
+### Wichtige Rahmenbedingungen & Prinzipien
+
+- **Reines Linux-Projekt**: Die Anwendung ist ausschließlich für Linux vorgesehen. Es dürfen keine Windows-spezifischen
+  Konstrukte oder bedingten Nicht-Linux-Kompilierungen (`#[cfg(target_os = ...)]`) hinzugefügt werden.
+- **Root-Rechte**: Die Anwendung erfordert Root-Rechte zur Verwaltung von Docker und Compose-Services. Fehlen diese,
+  eskaliert sie via `sudo`.
+- **Keine Unicode-Emojis im Logging**: Das Logging-Modul (`logger-ctdra`) verwendet einheitliche ASCII-Präfixe (`[!]`
+  Error, `[?]` Warn, `[i]` Info, `[d]` Debug).
+- **Lizenz**: GNU General Public License v3.0 or later (`GPL-3.0-or-later`).
+
+---
+
+## 2. Modul- und Codestruktur
+
+```text
+DockerUpdate/
+├── .gitea/
+│   └── workflows/
+│       ├── testing.yaml # CI/CD für testing-Branch (Tests, Testing-Packages & Preview-Release)
+│       └── main.yaml    # CI/CD für main-Branch (Tests, Stable-Packages & Release)
+├── scripts/
+│   ├── get-build-number.py # Ermittelt dynamisch die nächste Build-Nummer für Pakete
+│   └── package-arch.py     # Hilfsskript zur Arch-Linux-Paketerstellung (.pkg.tar.zst)
+├── Cargo.toml          # Rust-Manifest, Abhängigkeiten und Metadaten für deb / generate-rpm / arch
+├── Cargo.lock
+├── LICENSE             # GPL-3.0 Lizenztext
+├── README.md           # Projektdokumentation für Endanwender und Administratoren
+├── AGENTS.md           # Richtlinien und Dokumentation für Agenten
+├── tests/
+│   ├── config.rs       # Tests für Konfigurationsdatenstrukturen
+│   └── updater.rs      # Tests für Updater-Hilfsfunktionen und Compose-Parsing
+└── src/
+    ├── main.rs         # Einstiegspunkt, Root-Prüfung, Ausführung
+    ├── lib.rs          # Bibliotheksexporte für Module und Tests
+    ├── config.rs       # Konfigurationsdatenstrukturen (config-ctdra / TOML)
+    └── updater.rs      # Scan-, Pull-, Restart- und Bereinigungslogik für Compose-Apps
+```
+
+### Modulverantwortlichkeiten
+
+- **`src/main.rs`**:
+  Initialer Startpunkt. Prüft mit `sudo_ctdra::is_run_as_root()`, ob Root-Rechte vorliegen. Wenn nicht, wird mit
+  `sudo_ctdra::run_as_root()` neu gestartet. Initialisiert das Logging über `logger-ctdra` anhand der Konfiguration und
+  ruft anschließend `updater::run_updates()` auf.
+- **`src/updater.rs`**:
+    - Sucht in Unterverzeichnissen von `apps_dir` nach Compose-Dateien (`docker-compose.yaml`, `docker-compose.yml`,
+      `compose.yaml`, `compose.yml`).
+  - Parst Services via `serde-saphyr` und filtert mit `is_latest_image()` nach Services mit `:latest`-Images oder ohne
+      expliziten Tag.
+    - Führt `docker pull` für jedes gefundene Image aus und vergleicht Vorher/Nachher-Image-IDs via
+      `docker image inspect`.
+    - Startet bei Änderungen Services neu (`docker compose up -d` mit Fallback auf `docker-compose up -d`).
+    - Führt nach Updates `docker image prune -f` aus.
+- **`src/config.rs`**:
+    - Definiert die Konfigurationsdatenstrukturen (`AppConfig`, `General` mit `apps_dir` und `log_level`).
+    - Lädt und verwaltet die Konfiguration über `config-ctdra` (Standardpfade: `/etc/docker-update/config.toml` bzw.
+      `~/.config/docker-update/config.toml`).
+- **`.gitea/workflows/`**:
+    - `testing.yaml`: Führt bei Push auf `testing` Tests und Builds durch, veröffentlicht Pakete in der Gitea Package
+      Registry
+      (`distribution: testing`, `component: main` bzw. Gruppe/Repo `testing`) und erstellt ein Gitea Preview-Release mit
+      den Paketen als Assets.
+    - `main.yaml`: Führt bei Push auf `main` Tests und Builds durch, veröffentlicht Pakete in der Gitea Package Registry
+      (`distribution: stable`, `component: main` bzw. Gruppe/Repo `stable`) und erstellt ein Gitea Release mit den
+      Paketen als Assets.
+
+---
+
+## 3. Build-, Test- und Prüfbefehle
+
+Vor jedem Commit oder Abschluss einer Aufgabe müssen folgende Befehle erfolgreich durchlaufen:
+
+```bash
+# 1. Compiler- und Typ-Prüfung für alle Targets
+cargo check --all-targets
+
+# 2. Ausführen aller Unit-Tests
+cargo test
+
+# 3. Release-Build kompilieren
+cargo build --release
+```
+
+### Optionale Paketierungsbefehle (lokale Validierung)
+
+```bash
+# Debian-Paket (.deb) erstellen (benötigt cargo-deb)
+cargo deb
+
+# Fedora / RPM-Paket (.rpm) erstellen (benötigt cargo-generate-rpm)
+cargo generate-rpm
+
+# Arch Linux-Paket (.pkg.tar.zst) erstellen
+python3 scripts/package-arch.py
+```
+
+---
+
+## 4. Richtlinien für Änderungen
+
+1. **Abwärtskompatibilität & Pfade**:
+   Der Standard-Apps-Pfad `/var/apps` und die Konfigurationspfade dürfen nicht ohne triftigen Grund geändert werden.
+2. **Paketierungsdefinitionen in Cargo.toml pflegen**:
+   Alle Paketierungsdefinitionen für Debian, RPM und Arch Linux werden zentral in `Cargo.toml` verwaltet
+   (`[package.metadata.deb]`, `[package.metadata.generate-rpm]`, `[package.metadata.arch]`). Es wird kein separater
+   `packaging/`-Ordner benötigt.
+3. **Automatisierung**:
+   Die empfohlene Automatisierungsmethode ist **Cron** (`/etc/cron.d/docker-update` oder `crontab -e`).
+4. **Keine Mocking-Bypässe**:
+   Tests dürfen nicht gelöscht, ignoriert oder durch leere Dummy-Assertions ersetzt werden.
+5. **CI/CD & Release-Konsistenz**:
+   Workflows in `.gitea/workflows/` müssen bei strukturellen Paket- oder Release-Anpassungen konsistent zu `Cargo.toml`
+   gehalten werden.

Cargo.lock

@@ -0,0 +1,541 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "annotate-snippets"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1"
+dependencies = [
+ "anstyle",
+ "memchr",
+ "unicode-width",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "config-ctdra"
+version = "1.0.6"
+source = "sparse+https://gitea.creative-dragonslayer.de/api/packages/Rust-Crates/cargo/"
+checksum = "83eb23d473fce79e8234ad66baf210289b5c9e4c4a587273b4df7deceb73f416"
+dependencies = [
+ "confy",
+ "program-ctdra",
+ "serde",
+ "sudo-ctdra",
+]
+
+[[package]]
+name = "confy"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8807c397789cbe02bbdb1a27ea5f345584132808697b2a3f957c829829ee4814"
+dependencies = [
+ "etcetera",
+ "lazy_static",
+ "serde",
+ "thiserror",
+ "toml",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "docker-update"
+version = "1.2.3"
+dependencies = [
+ "config-ctdra",
+ "logger-ctdra",
+ "serde",
+ "serde-saphyr",
+ "sudo-ctdra",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22"
+dependencies = [
+ "encoding_rs",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "etcetera"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c7b13d0780cb82722fd59f6f57f925e143427e4a75313a6c77243bf5326ae6"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "granit-parser"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e20f99e46474f56bd905c56e817ebddcf377a611f94c53ac4649e4d3fa3c0cd0"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libc"
+version = "1.0.0-alpha.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d0f24f33af482526a4e3f9b47f0abb2c6377a1713c8aa4a8106994689a4cfa5"
+
+[[package]]
+name = "logger-ctdra"
+version = "1.0.5"
+source = "sparse+https://gitea.creative-dragonslayer.de/api/packages/Rust-Crates/cargo/"
+checksum = "ce612b7d943b77060fa36eab0c85782e650c4cf023e9d560bef791951ed92cad"
+dependencies = [
+ "program-ctdra",
+ "time",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc 0.2.189",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "program-ctdra"
+version = "1.0.0"
+source = "sparse+https://gitea.creative-dragonslayer.de/api/packages/Rust-Crates/cargo/"
+checksum = "54f20af67f90bf6d10697dd77bb4beb41dafad7fe0fb46aacfc81ad45a8e48bd"
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-saphyr"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8050abb251097357e24aff63ba2c52a6309ecb7d23a5474023df960a02694d8"
+dependencies = [
+ "annotate-snippets",
+ "base64",
+ "encoding_rs_io",
+ "granit-parser",
+ "nohash-hasher",
+ "num-traits",
+ "serde_core",
+ "smallvec",
+ "zmij",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "sudo-ctdra"
+version = "1.0.1"
+source = "sparse+https://gitea.creative-dragonslayer.de/api/packages/Rust-Crates/cargo/"
+checksum = "20e576be60eb2050d475d0fbe46f0d09462ba9985ab55c7833e0c2e6d116d341"
+dependencies = [
+ "libc 1.0.0-alpha.4",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "libc 0.2.189",
+ "num-conv",
+ "num_threads",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

Cargo.toml

@@ -0,0 +1,51 @@
+[package]
+name = "docker-update"
+version = "1.2.3"
+edition = "2024"
+authors = ['DragonSlayer_14']
+readme = "README.md"
+license = "GPL-3.0-or-later"
+repository = "https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate"
+description = "Automatisches Aktualisieren von Docker-Compose-Anwendungen in /var/apps mit :latest-Images"
+
+[dependencies]
+serde = { version = "1.0.229", features = ["derive"] }
+serde-saphyr = "1.1.0"
+logger-ctdra = { version = "1.0.3", registry = "gitea" }
+sudo-ctdra = { version = "1.0.0", registry = "gitea" }
+config-ctdra = { version = "1.0.4", registry = "gitea" }
+
+[profile.release]
+debug = "none"
+
+[package.metadata.deb]
+name = "docker-update"
+maintainer = "DragonSlayer_14"
+copyright = "2026 Linuxapps"
+section = "utils"
+priority = "optional"
+depends = "$auto, sudo, docker-ce-cli, docker-compose-plugin"
+extended-description = """\
+DockerUpdate durchsucht Verzeichnisse (standardmäßig in /var/apps) nach
+Docker-Compose-Dateien mit ':latest'-Images, prüft auf neuere Images,
+lädt diese herunter und startet die betroffenen Container automatisch neu.\
+"""
+assets = [
+    ["target/release/docker-update", "usr/bin/docker-update", "755"],
+    ["README.md", "usr/share/doc/docker-update/README.md", "644"],
+    ["LICENSE", "usr/share/doc/docker-update/copyright", "644"],
+]
+
+[package.metadata.generate-rpm]
+assets = [
+    { source = "target/release/docker-update", dest = "/usr/bin/docker-update", mode = "755" },
+    { source = "README.md", dest = "/usr/share/doc/docker-update/README.md", mode = "644", doc = true },
+    { source = "LICENSE", dest = "/usr/share/licenses/docker-update/LICENSE", mode = "644", license = true },
+]
+requires = { "sudo" = "*", "docker" = "*" }
+
+[package.metadata.arch]
+pkgrel = "1"
+arch = "x86_64"
+depends = ["gcc-libs", "glibc", "sudo", "docker-ce-cli", "docker-compose-plugin"]
+optdepends = ["docker-compose: Unterstützung für Docker Compose v1"]

README.md

@@ -1,3 +1,354 @@
-# DockerUpdater
+# DockerUpdate (`docker-update`)
 
-Hilft dabei installierte Anwendungen über docker-compose.yaml in /var/apps aktuell zu halten.
+[![Main Release & Publish](https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate/actions/workflows/main.yaml/badge.svg?branch=main)](https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate/actions?workflow=main.yaml)
+[![Testing Build, Publish & Preview Release](https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate/actions/workflows/testing.yaml/badge.svg?branch=testing)](https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate/actions?workflow=testing.yaml)
+
+`docker-update` ist ein schlankes CLI-Werkzeug für Linux-Server, das Docker-Compose-basierte Applikationen automatisch
+auf neuere Versionen prüft, aktualisiert und neu startet.
+
+## Funktionsweise
+
+1. **Durchsuchen von Applikationsverzeichnissen**:
+   Standardmäßig scannt `docker-update` alle Unterverzeichnisse in `/var/apps/` (konfigurierbar) nach gültigen
+   Compose-Dateien (`docker-compose.yaml`, `docker-compose.yml`, `compose.yaml`, `compose.yml`).
+2. **Erkennung von `:latest`-Images**:
+   Services in den Compose-Dateien werden analysiert. Es werden gezielt Services berücksichtigt, deren Image das
+   `:latest`-Tag nutzt oder implizit auf `latest` verweist (kein Tag angegeben).
+3. **Prüfung auf neuere Images & Download**:
+   Das Programm führt für jedes betroffene Image einen `docker pull` durch und vergleicht die Image-IDs vor und nach dem
+   Pull.
+4. **Automatischer Neustart**:
+   Wurde ein neues Image heruntergeladen, wird die Applikation im jeweiligen Verzeichnis über `docker compose up -d`
+   (mit Fallback auf `docker-compose up -d`) aktualisiert und neu gestartet.
+5. **Bereinigung**:
+   Nach erfolgreichen Aktualisierungen werden ungenutzte Zwischen-Images automatisch mittels `docker image prune -f`
+   bereinigt.
+6. **Berechtigungen & Logging**:
+   Wird das Programm ohne Root-Rechte gestartet, startet es sich automatisch über `sudo` mit erhöhten Rechten neu.
+   Ausgaben werden auf der Konsole formatiert und zusätzlich tagesbasiert im System-Temp-Verzeichnis protokolliert (z.
+   B. `/tmp/docker-update-.../log-YYYY-MM-DD.log`).
+
+---
+
+## Voraussetzungen
+
+- **Betriebssystem**: Linux (amd64 / x86_64, arm64 / aarch64, i386 / i686)
+- **Laufzeit-Abhängigkeiten**:
+    - `docker` (inkl. Docker Compose Plugin `docker compose` oder Standalone `docker-compose`)
+    - `sudo`
+- **Build-Abhängigkeiten** (nur zum Kompilieren/Paketieren):
+    - Rust & Cargo (Rust 2024 Edition / 1.85+)
+
+---
+
+## Installation aus der Gitea-Paket-Registry
+
+Über die CI/CD-Pipelines werden bei jedem Push auf den `main`-Branch (Release / Stable) und `testing`-Branch (Preview /
+Testing) automatisch Pakete für **Debian/Ubuntu**, **Fedora/RHEL** und **Arch Linux** in der Gitea-Paket-Registry
+bereitgestellt.
+
+### 1. Debian / Ubuntu (`apt`)
+
+#### Stable (Produktiv)
+
+Füge das Repository zu deinen APT-Quellen hinzu:
+
+```bash
+# Keyring installieren
+sudo curl https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/debian/repository.key -o /etc/apt/keyrings/gitea-Linuxapps.asc
+# Repository-Eintrag anlegen
+echo "deb [signed-by=/etc/apt/keyrings/gitea-Linuxapps.asc] https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/debian stable main" | sudo tee -a /etc/apt/sources.list.d/gitea.list
+
+# Paketliste aktualisieren und installieren
+sudo apt update
+sudo apt install docker-update
+```
+
+#### Testing (Vorschau / Testing)
+
+```bash
+# Keyring installieren
+sudo curl https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/debian/repository.key -o /etc/apt/keyrings/gitea-Linuxapps.asc
+# Testing-Repository-Eintrag anlegen
+echo "deb [signed-by=/etc/apt/keyrings/gitea-Linuxapps.asc] https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/debian testing main" | sudo tee -a /etc/apt/sources.list.d/gitea.list
+
+# Paketliste aktualisieren und installieren
+sudo apt update
+sudo apt install docker-update
+```
+
+---
+
+### 2. RedHat / Fedora / SUSE
+
+#### Stable (Produktiv)
+
+Repository einrichten:
+```bash
+# auf RedHat-basierten Distributionen
+dnf config-manager --add-repo https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/stable.repo
+
+# Fedora 41+ (DNF5)
+dnf config-manager addrepo --from-repofile=https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/stable.repo
+
+# auf SUSE-basierten Distributionen
+zypper addrepo https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/stable.repo
+```
+
+Paket installieren:
+
+```bash
+# auf RedHat-basierten Distributionen
+dnf install docker-update
+
+# auf SUSE-basierten Distributionen
+zypper install docker-update
+```
+
+#### Testing (Vorschau / Testing)
+
+Repository einrichten:
+```bash
+# auf RedHat-basierten Distributionen
+dnf config-manager --add-repo https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/testing.repo
+
+# Fedora 41+ (DNF5)
+dnf config-manager addrepo --from-repofile=https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/testing.repo
+
+# auf SUSE-basierten Distributionen
+zypper addrepo https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/rpm/testing.repo
+```
+
+Paket installieren:
+
+```bash
+# auf RedHat-basierten Distributionen
+dnf install docker-update
+
+# auf SUSE-basierten Distributionen
+zypper install docker-update
+```
+
+---
+
+### 3. Arch Linux (`pacman`)
+
+### Installiere den GPG-Key für das Repository
+
+Key herunterladen:
+
+```bash
+wget https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/arch/repository.key
+```
+
+ID des Keys anzeigen lassen:
+
+```bash
+gpg --show-keys repository.key
+```
+
+Key zu pacman hinzufügen und signieren:
+
+```
+pacman-key --add repository.key
+pacman-key --lsign-key {key id}
+```
+
+{key id} = ID aus dem vorherigen Schritt
+
+#### Stable (Produktiv)
+
+Füge das Repository in `/etc/pacman.conf` ein:
+```ini
+[stable]
+SigLevel = Optional TrustAll
+Server = https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/arch/stable/$arch
+```
+
+Installiere das Paket anschließend:
+
+```bash
+sudo pacman -Sy docker-update
+```
+
+#### Testing (Vorschau / Testing)
+
+Füge das Testing-Repository in `/etc/pacman.conf` ein:
+
+```ini
+[testing]
+SigLevel = Optional TrustAll
+Server = https://gitea.creative-dragonslayer.de/api/packages/Linuxapps/arch/testing/$arch
+```
+
+Installiere das Paket:
+
+```bash
+sudo pacman -Sy docker-update
+```
+
+---
+
+### Download vorgefertigter Pakete (Releases)
+
+Alternativ können vorkompilierte Pakete (`.deb`, `.rpm`, `.pkg.tar.zst`) auch direkt aus den Releases heruntergeladen
+und manuell installiert werden:
+
+- **Stable-Releases**: [Gitea Releases](https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate/releases)
+- **Preview-Releases (Testing)**: Markiert als Vorabveröffentlichung (*Pre-release*) mit dem Tag `v<VERSION>-preview`.
+
+---
+
+## Manuelle Installation (Build from Source)
+
+```bash
+# Repository klonen
+git clone https://gitea.creative-dragonslayer.de/Linuxapps/DockerUpdate.git
+cd DockerUpdate
+
+# Release-Binary kompilieren
+cargo build --release
+
+# Binary ins Systemverzeichnis installieren
+sudo install -m 755 target/release/docker-update /usr/bin/docker-update
+```
+
+Anschließend kann das Programm direkt über `docker-update` ausgeführt werden:
+
+```bash
+docker-update
+```
+
+---
+
+## Konfiguration
+
+Die Konfigurationsdatei wird standardmäßig unter folgendem Pfad abgelegt:
+
+- **Root-Ausführung**: `/etc/docker-update/config.toml`
+- **Benutzer-Ausführung**: `~/.config/docker-update/config.toml`
+
+Wird keine Datei gefunden, verwendet `docker-update` die Standardwerte.
+
+### Beispiel-Konfiguration (`config.toml`)
+
+```toml
+[general]
+# Verzeichnis, in dem sich die Applikationsordner mit Compose-Dateien befinden
+apps_dir = "/var/apps"
+
+# Log-Level: "error", "warn", "info", "debug"
+log_level = "info"
+```
+
+---
+
+## Paketerstellung
+
+Für gängige Linux-Distributionen stehen vorbereitete Paketierungsdefinitionen zur Verfügung.
+
+### 1. Debian / Ubuntu (`.deb`)
+
+Das Debian-Paket kann mithilfe von [`cargo-deb`](https://github.com/kornelski/cargo-deb) erstellt werden:
+
+```bash
+# cargo-deb installieren (falls noch nicht vorhanden)
+cargo install cargo-deb
+
+# Release-Build und Debian-Paket erstellen
+cargo deb
+
+# Installation des erstellten Pakets
+sudo dpkg -i target/debian/docker-update_*.deb
+```
+
+Die Paketkonfiguration und Abhängigkeiten (`sudo`, `docker.io | docker-ce`) sind in `Cargo.toml` unter
+`[package.metadata.deb]` definiert.
+
+---
+
+### 2. Arch Linux (`.pkg.tar.zst`)
+
+Die Paketmetadaten und Abhängigkeiten für Arch Linux sind direkt in `Cargo.toml` unter `[package.metadata.arch]`
+hinterlegt. Das Paket kann nach dem Kompilieren des Release-Builds über das Skript `scripts/package-arch.py` (analog zu
+CI/CD) erzeugt werden (optional mit `--target <TRIPLE>` für Cross-Builds):
+
+```bash
+# Release kompilieren
+cargo build --release
+
+# Arch Linux-Paket (.pkg.tar.zst) erstellen (Standard: Host/x86_64)
+python3 scripts/package-arch.py
+
+# Optional für spezifische Zielarchitektur:
+# python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu
+# python3 scripts/package-arch.py --target i686-unknown-linux-gnu
+
+# Installation des erstellten Pakets
+sudo pacman -U target/arch/docker-update-*.pkg.tar.zst
+```
+
+---
+
+### 3. Fedora / RHEL / CentOS (`.rpm`)
+
+Das RPM-Paket wird mithilfe von [`cargo-generate-rpm`](https://github.com/cat-in-136/cargo-generate-rpm) direkt aus den
+Metadaten in `Cargo.toml` (`[package.metadata.generate-rpm]`) erstellt:
+
+```bash
+# cargo-generate-rpm installieren (falls noch nicht vorhanden)
+cargo install cargo-generate-rpm
+
+# Release bauen und RPM erzeugen
+cargo build --release
+cargo generate-rpm
+
+# Optional für spezifische Zielarchitektur (z.B. Cross-Builds):
+# mkdir -p target/generate-rpm
+# cargo generate-rpm --target aarch64-unknown-linux-gnu -o target/generate-rpm
+# cargo generate-rpm --target i686-unknown-linux-gnu -o target/generate-rpm
+
+# Installation des erstellten RPM-Pakets
+sudo dnf install target/generate-rpm/docker-update-*.rpm
+```
+
+---
+
+## Automatisierung (Cron)
+
+Um `docker-update` regelmäßig (z. B. täglich nachts um 03:30 Uhr) automatisch auszuführen, kann ein Cronjob eingerichtet
+werden. Da `docker-update` Root-Rechte benötigt, sollte der Cronjob mit Root-Rechten ausgeführt werden.
+
+### Option A: Über `/etc/cron.d/docker-update` (Empfohlen für Server)
+
+Erstelle eine Datei `/etc/cron.d/docker-update`:
+
+```bash
+sudo tee /etc/cron.d/docker-update << 'EOF'
+# Täglich um 03:30 Uhr docker-update als root ausführen
+30 3 * * * root /usr/bin/docker-update >/dev/null 2>&1
+EOF
+
+sudo chmod 644 /etc/cron.d/docker-update
+```
+
+### Option B: Über die Root-Crontab (`crontab -e`)
+
+Öffne die Crontab des Root-Benutzers:
+
+```bash
+sudo crontab -e
+```
+
+Füge folgende Zeile ein:
+
+```cron
+30 3 * * * /usr/bin/docker-update >/dev/null 2>&1
+```
+
+---
+
+## Lizenz
+
+Dieses Projekt ist unter der **GNU General Public License v3.0 or later (GPL-3.0-or-later)** lizenziert. Weitere
+Informationen finden sich in der Datei [LICENSE](LICENSE).

qodana.yaml

@@ -0,0 +1,50 @@
+#-------------------------------------------------------------------------------#
+#               Qodana analysis is configured by qodana.yaml file               #
+#             https://www.jetbrains.com/help/qodana/qodana-yaml.html            #
+#-------------------------------------------------------------------------------#
+
+#################################################################################
+#              WARNING: Do not store sensitive information in this file,        #
+#               as its contents will be included in the Qodana report.          #
+#################################################################################
+version: "1.0"
+
+#Specify inspection profile for code analysis
+profile:
+  name: qodana.starter
+
+#Enable inspections
+#include:
+#  - name: <SomeEnabledInspectionId>
+
+#Disable inspections
+#exclude:
+#  - name: <SomeDisabledInspectionId>
+#    paths:
+#      - <path/where/not/run/inspection>
+
+#Execute shell command before Qodana execution (Applied in CI/CD pipeline)
+#bootstrap: sh ./prepare-qodana.sh
+
+#Install IDE plugins before Qodana execution (Applied in CI/CD pipeline)
+#plugins:
+#  - id: <plugin.id> #(plugin id can be found at https://plugins.jetbrains.com)
+
+# Quality gate. Will fail the CI/CD pipeline if any condition is not met
+# severityThresholds - configures maximum thresholds for different problem severities
+# testCoverageThresholds - configures minimum code coverage on a whole project and newly added code
+# dependencyLicenses - fails the run on prohibited or unknown dependency licenses
+# Code Coverage is available in Ultimate and Ultimate Plus plans
+#failureConditions:
+#  severityThresholds:
+#    any: 15
+#    critical: 5
+#  testCoverageThresholds:
+#    fresh: 70
+#    total: 50
+#  dependencyLicenses:
+#    failOnProhibited: true
+#    failOnUnknown: false
+
+#Specify Qodana linter for analysis (Applied in CI/CD pipeline)
+linter: jetbrains/qodana-<linter>:2026.2

renovate.json

@@ -0,0 +1,131 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "timezone": "Europe/Berlin",
+  "schedule": [
+    "before 6am"
+  ],
+  "baseBranchPatterns": [
+    "dev"
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": [
+        ".gitea/workflows/**"
+      ],
+      "groupName": "Gitea Actions",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "matchManagers": [
+        "cargo"
+      ],
+      "groupName": "Cargo Dependencies",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "matchManagers": [
+        "dockerfile",
+        "docker-compose"
+      ],
+      "groupName": "Docker-Images",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Patch-/Minor-/Digest-Updates automatisch mergen, sobald alle CI-Checks (inkl. Unit-Tests) erfolgreich sind - Major-Updates sind unten explizit ausgenommen (siehe nächste Regel).",
+      "matchUpdateTypes": [
+        "patch",
+        "minor",
+        "digest",
+        "lockFileMaintenance"
+      ],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Major-Updates immer manuell prüfen, da potenziell brechende Änderungen.",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "aquasecurity/trivy",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "OSV_SCANNER_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "google/osv-scanner",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "TRUFFLEHOG_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "trufflesecurity/trufflehog",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "CARGO_BINSTALL_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-bins/cargo-binstall",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "CARGO_DEB_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-deb",
+      "datasourceTemplate": "crate"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.+\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "CARGO_GENERATE_RPM_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-generate-rpm",
+      "datasourceTemplate": "crate"
+    }
+  ]
+}

scripts/get-build-number.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""
+Ermittelt automatisch die nächste Build-Nummer (Revision / Release / pkgrel)
+für eine gegebene Paket-Version (z. B. 1.0.2 -> wenn 1.0.2-1 existiert, wird 2 zurückgegeben).
+"""
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+# Paket-Typen, unter denen dasselbe Release veroeffentlicht wird und die sich
+# daher eine gemeinsame Build-Nummer teilen muessen.
+PACKAGE_TYPES = ("debian", "rpm", "arch")
+
+
+def get_cargo_pkg_info():
+    try:
+        metadata = json.loads(subprocess.check_output(["cargo", "metadata", "--format-version", "1", "--no-deps"]))
+        pkg = metadata["packages"][0]
+        name = pkg.get("name", "")
+        version = pkg.get("version", "0.0.0")
+        repository = pkg.get("repository", "")
+        return name, version, repository
+    except Exception:
+        # Fallback auf einfaches Parsen der Cargo.toml
+        name = ""
+        version = "0.0.0"
+        repository = ""
+        if os.path.exists("Cargo.toml"):
+            with open("Cargo.toml", "r") as f:
+                for line in f:
+                    line = line.strip()
+                    if line.startswith("name ="):
+                        name = line.split("=", 1)[1].strip().strip('"\'')
+                    elif line.startswith("version ="):
+                        version = line.split("=", 1)[1].strip().strip('"\'')
+                    elif line.startswith("repository ="):
+                        repository = line.split("=", 1)[1].strip().strip('"\'')
+        return name, version, repository
+
+
+def parse_repo_info(repo_url):
+    """Extrahiert Server-URL, Owner und Repo-Name aus einer Repository-URL."""
+    if not repo_url:
+        return None, None, None
+    parsed = urllib.parse.urlparse(repo_url)
+    server_url = f"{parsed.scheme}://{parsed.netloc}"
+    path_parts = [p for p in parsed.path.strip("/").split("/") if p]
+    if len(path_parts) >= 2:
+        owner = path_parts[0]
+        repo_name = path_parts[1]
+        if repo_name.endswith(".git"):
+            repo_name = repo_name[:-4]
+        return server_url, f"{owner}/{repo_name}", owner
+    return server_url, None, None
+
+
+def query_existing_build_numbers(name, version, gitea_url, repo, owner, token=None):
+    build_nums = set()
+    pattern = re.compile(rf'(?:{re.escape(name)}[_-]|^v?){re.escape(version)}-(\d+)')
+
+    headers = {"User-Agent": f"{name}-build-resolver" if name else "rust-build-resolver"}
+    if token:
+        headers["Authorization"] = f"token {token}"
+
+    # 1. Gitea Releases API
+    if gitea_url and repo:
+        try:
+            url = f"{gitea_url.rstrip('/')}/api/v1/repos/{repo}/releases?limit=50"
+            req = urllib.request.Request(url, headers=headers)
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                releases = json.loads(resp.read().decode())
+                for rel in releases:
+                    tag = rel.get("tag_name", "")
+                    m = pattern.search(tag)
+                    if m:
+                        build_nums.add(int(m.group(1)))
+                    for asset in rel.get("assets", []):
+                        asset_name = asset.get("name", "")
+                        m = pattern.search(asset_name)
+                        if m:
+                            build_nums.add(int(m.group(1)))
+        except Exception as e:
+            sys.stderr.write(f"[Hinweis] Konnte Gitea Releases nicht abfragen: {e}\n")
+
+    # 2. Gitea Packages API (falls Token vorhanden): pro Paket-Typ gezielt nur die
+    #    neueste Version abfragen (ein Request, keine Pagination noetig). Das haelt
+    #    die Abfrage schnell unabhaengig von der Historie und ist unbeeinflusst von
+    #    Docker-Tags/anderen Paket-Typen, die unter demselben Owner haengen.
+    if gitea_url and owner and token and name:
+        for pkg_type in PACKAGE_TYPES:
+            try:
+                url = (
+                    f"{gitea_url.rstrip('/')}/api/v1/packages/{owner}/"
+                    f"{pkg_type}/{urllib.parse.quote(name, safe='')}/-/latest"
+                )
+                req = urllib.request.Request(url, headers=headers)
+                with urllib.request.urlopen(req, timeout=10) as resp:
+                    pkg = json.loads(resp.read().decode())
+                    pkg_ver = pkg.get("version", "")
+                    m = pattern.search(pkg_ver)
+                    if m:
+                        build_nums.add(int(m.group(1)))
+            except urllib.error.HTTPError as e:
+                if e.code != 404:
+                    sys.stderr.write(f"[Hinweis] Konnte neueste {pkg_type}-Paketversion nicht abfragen: {e}\n")
+            except Exception as e:
+                sys.stderr.write(f"[Hinweis] Konnte neueste {pkg_type}-Paketversion nicht abfragen: {e}\n")
+
+    # 3. Lokales Target-Verzeichnis prüfen
+    target_dirs = ["target/debian", "target/generate-rpm", "target/arch"]
+    for t_dir in target_dirs:
+        if os.path.isdir(t_dir):
+            for file in os.listdir(t_dir):
+                m = pattern.search(file)
+                if m:
+                    build_nums.add(int(m.group(1)))
+
+    return build_nums
+
+
+def get_next_build_number(version=None, gitea_url=None, repo=None, owner=None, token=None, explicit_build_num=None):
+    if explicit_build_num is not None:
+        return int(explicit_build_num)
+
+    env_build_num = os.environ.get("BUILD_NUMBER") or os.environ.get("BUILD_NUM") or os.environ.get("PKGREL")
+    if env_build_num:
+        try:
+            return int(env_build_num)
+        except ValueError:
+            pass
+
+    pkg_name, pkg_version, pkg_repo = get_cargo_pkg_info()
+    if not version:
+        version = pkg_version
+
+    default_server, default_repo, default_owner = parse_repo_info(pkg_repo)
+
+    gitea_url = gitea_url or os.environ.get("GITEA_URL") or os.environ.get("GITHUB_SERVER_URL") or default_server
+    repo = repo or os.environ.get("REPO") or os.environ.get("GITHUB_REPOSITORY") or default_repo
+    owner = owner or os.environ.get("REPO_OWNER") or os.environ.get("GITHUB_REPOSITORY_OWNER") or default_owner
+    token = token or os.environ.get("TOKEN") or os.environ.get("GITEA_TOKEN") or os.environ.get("PACKAGE_TOKEN") or os.environ.get("RELEASE_TOKEN")
+
+    existing_nums = query_existing_build_numbers(pkg_name, version, gitea_url, repo, owner, token)
+    if existing_nums:
+        return max(existing_nums) + 1
+    return 1
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Ermittelt die nächste Build-Nummer für die Paketierung.")
+    parser.add_argument("--version", help="Paket-Version (Standard: aus Cargo.toml)")
+    parser.add_argument("--gitea-url", help="Gitea Basis-URL")
+    parser.add_argument("--repo", help="Repository (z. B. Owner/Repo)")
+    parser.add_argument("--owner", help="Repository Owner / Organisation")
+    parser.add_argument("--token", help="API-Token")
+    parser.add_argument("--build-number", type=int, help="Explizite Build-Nummer erzwingen")
+
+    args = parser.parse_args()
+
+    build_num = get_next_build_number(
+        version=args.version,
+        gitea_url=args.gitea_url,
+        repo=args.repo,
+        owner=args.owner,
+        token=args.token,
+        explicit_build_num=args.build_number,
+    )
+    print(build_num)
+
+
+if __name__ == "__main__":
+    main()

scripts/package-arch.py

@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+import argparse
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import time
+
+TARGET_ARCH_MAP = {
+    "x86_64-unknown-linux-gnu": "x86_64",
+    "x86_64-unknown-linux-musl": "x86_64",
+    "x86_64": "x86_64",
+    "amd64": "x86_64",
+    "aarch64-unknown-linux-gnu": "aarch64",
+    "aarch64-unknown-linux-musl": "aarch64",
+    "aarch64": "aarch64",
+    "arm64": "aarch64",
+    "i686-unknown-linux-gnu": "i686",
+    "i686-unknown-linux-musl": "i686",
+    "i686": "i686",
+    "i386": "i686",
+}
+
+
+def resolve_pkgrel(version=None, default="1"):
+    # 1. Environment Variable
+    env_pkgrel = os.environ.get("BUILD_NUMBER") or os.environ.get("BUILD_NUM") or os.environ.get("PKGREL")
+    if env_pkgrel:
+        return str(env_pkgrel)
+
+    # 2. get-build-number.py falls vorhanden
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    getter_path = os.path.join(script_dir, "get-build-number.py")
+    if os.path.exists(getter_path):
+        try:
+            spec = importlib.util.spec_from_file_location("get_build_number", getter_path)
+            module = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(module)
+            return str(module.get_next_build_number(version=version))
+        except Exception as e:
+            sys.stderr.write(f"[Hinweis] Konnte get-build-number nicht ausführen: {e}\n")
+
+    return str(default)
+
+
+def build_package(target_triple=None, target_arch=None, pkgrel=None):
+    metadata = json.loads(subprocess.check_output(["cargo", "metadata", "--format-version", "1", "--no-deps"]))
+    pkg = metadata["packages"][0]
+    name = pkg["name"]
+    version = pkg["version"]
+    description = pkg.get("description", "")
+    license_name = pkg.get("license", "")
+    repository = pkg.get("repository", "")
+    authors = pkg.get("authors", [])
+    author = authors[0] if authors else "Unknown"
+
+    arch_meta = pkg.get("metadata", {}).get("arch", {})
+    default_pkgrel = arch_meta.get("pkgrel", "1")
+    if not pkgrel:
+        pkgrel = resolve_pkgrel(version=version, default=default_pkgrel)
+    default_arch = arch_meta.get("arch", "x86_64")
+
+    if target_arch:
+        arch = TARGET_ARCH_MAP.get(target_arch, target_arch)
+    elif target_triple:
+        arch = TARGET_ARCH_MAP.get(target_triple, default_arch)
+    else:
+        arch = default_arch
+
+    candidate_paths = []
+    if target_triple:
+        candidate_paths.append(f"target/{target_triple}/release/{name}")
+    candidate_paths.append(f"target/release/{name}")
+
+    bin_path = None
+    for p in candidate_paths:
+        if os.path.exists(p):
+            bin_path = p
+            break
+
+    if not bin_path:
+        raise FileNotFoundError(
+            f"Keine kompilierte Binary für {name} gefunden. Gesuchte Pfade: {candidate_paths}"
+        )
+
+    depends = arch_meta.get("depends", ["gcc-libs", "glibc"])
+    optdepends = arch_meta.get("optdepends", [])
+
+    with tempfile.TemporaryDirectory() as build_dir:
+        bin_dir = os.path.join(build_dir, "usr/bin")
+        doc_dir = os.path.join(build_dir, f"usr/share/doc/{name}")
+        lic_dir = os.path.join(build_dir, f"usr/share/licenses/{name}")
+        os.makedirs(bin_dir, exist_ok=True)
+        os.makedirs(doc_dir, exist_ok=True)
+        os.makedirs(lic_dir, exist_ok=True)
+
+        subprocess.run(["install", "-m", "755", bin_path, f"{bin_dir}/{name}"], check=True)
+        if os.path.exists("LICENSE"):
+            subprocess.run(["install", "-m", "644", "LICENSE", f"{lic_dir}/LICENSE"], check=True)
+        if os.path.exists("README.md"):
+            subprocess.run(["install", "-m", "644", "README.md", f"{doc_dir}/README.md"], check=True)
+
+        installed_size = subprocess.check_output(["du", "-sb", build_dir]).decode().split()[0]
+        builddate = str(int(time.time()))
+
+        pkginfo_lines = [
+            f"pkgname = {name}",
+            f"pkgbase = {name}",
+            f"pkgver = {version}-{pkgrel}",
+            f"pkgdesc = {description}",
+            f"url = {repository}",
+            f"builddate = {builddate}",
+            f"packager = {author}",
+            f"size = {installed_size}",
+            f"arch = {arch}",
+            f"license = {license_name}",
+        ]
+        for dep in depends:
+            pkginfo_lines.append(f"depend = {dep}")
+        for optdep in optdepends:
+            pkginfo_lines.append(f"optdepend = {optdep}")
+        pkginfo_lines.append("makepkgopt = strip\n")
+
+        with open(os.path.join(build_dir, ".PKGINFO"), "w") as f:
+            f.write("\n".join(pkginfo_lines))
+
+        os.makedirs("target/arch", exist_ok=True)
+        output_file = os.path.abspath(f"target/arch/{name}-{version}-{pkgrel}-{arch}.pkg.tar.zst")
+        subprocess.run(["tar", "--zstd", "-cf", output_file, ".PKGINFO", "usr"], cwd=build_dir, check=True)
+        print(f"Arch-Paket erfolgreich erstellt: {output_file}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Erstellt Arch Linux-Pakete (.pkg.tar.zst)")
+    parser.add_argument("--target", help="Rust Target-Triple (z.B. x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, i686-unknown-linux-gnu)")
+    parser.add_argument("--arch", help="Architektur (z.B. x86_64, aarch64, i686)")
+    parser.add_argument("--pkgrel", help="Release-/Build-Nummer (z.B. 1, 2, ...)")
+    args = parser.parse_args()
+
+    build_package(target_triple=args.target, target_arch=args.arch, pkgrel=args.pkgrel)
+
+
+if __name__ == "__main__":
+    main()

scripts/report-security-issue.py

@@ -0,0 +1,315 @@
+#!/usr/bin/env python3
+"""Erstellt oder kommentiert ein Gitea-Issue mit den Ergebnissen der Security-Scans.
+
+Sucht ein offenes Issue mit dem Label ISSUE_LABEL (Standard: "security-scan").
+Existiert eines, wird der aktuelle Scan-Stand als neuer Kommentar angehängt
+(die Historie bleibt erhalten). Existiert keines (z.B. weil das letzte
+geschlossen wurde), wird ein neues Issue erstellt. Gibt es keine Funde mehr,
+wird ein offenes Issue nur kommentiert, nicht geschlossen.
+
+Titel und Label lassen sich per Umgebungsvariable ISSUE_TITLE / ISSUE_LABEL
+überschreiben, damit z.B. TruffleHog-Funde in ein eigenes Issue laufen statt
+in das gemeinsame Trivy/OSV-Issue.
+"""
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+LABEL_NAME = os.environ.get("ISSUE_LABEL", "security-scan")
+LABEL_COLOR = "#b60205"
+ISSUE_TITLE = os.environ.get("ISSUE_TITLE", "Security-Scan: Offene Schwachstellen")
+
+SEVERITY_ORDER = {
+    "VERIFIED": -1,
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "UNKNOWN": 4,
+    "UNVERIFIED": 6,
+}
+
+
+def api(method, path, token, gitea_url, data=None):
+    url = f"{gitea_url}/api/v1{path}"
+    body = json.dumps(data).encode() if data is not None else None
+    req = urllib.request.Request(url, data=body, method=method)
+    req.add_header("Authorization", f"token {token}")
+    req.add_header("Content-Type", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            raw = resp.read()
+            return json.loads(raw) if raw else None
+    except urllib.error.HTTPError as e:
+        print(f"Gitea API Fehler ({method} {path}): {e.code} {e.read().decode()}", file=sys.stderr)
+        raise
+
+
+def make_finding(source, id, severity, package, installed="-", fixed="-", target="-"):
+    return {
+        "source": source,
+        "id": id,
+        "severity": severity,
+        "package": package,
+        "installed": installed,
+        "fixed": fixed,
+        "target": target,
+    }
+
+
+def cvss_score_to_severity(score):
+    try:
+        score = float(score)
+    except (TypeError, ValueError):
+        return "UNKNOWN"
+    if score >= 9.0:
+        return "CRITICAL"
+    if score >= 7.0:
+        return "HIGH"
+    if score >= 4.0:
+        return "MEDIUM"
+    if score > 0.0:
+        return "LOW"
+    return "UNKNOWN"
+
+
+def load_trivy(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("Results", []) or []:
+        target = result.get("Target", "?")
+        for vuln in result.get("Vulnerabilities", []) or []:
+            findings.append(make_finding(
+                "Trivy",
+                vuln.get("VulnerabilityID", "?"),
+                vuln.get("Severity", "UNKNOWN"),
+                vuln.get("PkgName", "?"),
+                installed=vuln.get("InstalledVersion", "?"),
+                fixed=vuln.get("FixedVersion") or "-",
+                target=target,
+            ))
+        for misc in result.get("Misconfigurations", []) or []:
+            findings.append(make_finding(
+                "Trivy (Misconfig)",
+                misc.get("ID", "?"),
+                misc.get("Severity", "UNKNOWN"),
+                misc.get("Title", "?"),
+                target=target,
+            ))
+        for secret in result.get("Secrets", []) or []:
+            findings.append(make_finding(
+                "Trivy (Secret)",
+                secret.get("RuleID", "?"),
+                secret.get("Severity", "UNKNOWN"),
+                secret.get("Title", "?"),
+                target=target,
+            ))
+    return findings
+
+
+def load_osv(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("results", []) or []:
+        source = (result.get("source") or {}).get("path", "?")
+        for pkg in result.get("packages", []) or []:
+            info = pkg.get("package", {})
+            pkg_name = f"{info.get('name', '?')} ({info.get('ecosystem', '?')})"
+            severity_by_id = {}
+            for group in pkg.get("groups", []) or []:
+                label = cvss_score_to_severity(group.get("max_severity"))
+                for vuln_id in group.get("ids", []) or []:
+                    severity_by_id[vuln_id] = label
+            for vuln in pkg.get("vulnerabilities", []) or []:
+                vuln_id = vuln.get("id", "?")
+                findings.append(make_finding(
+                    "OSV-Scanner",
+                    vuln_id,
+                    severity_by_id.get(vuln_id, "UNKNOWN"),
+                    pkg_name,
+                    installed=info.get("version", "?"),
+                    target=source,
+                ))
+    return findings
+
+
+def load_trufflehog(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        for line in f:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                entry = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            git_meta = ((entry.get("SourceMetadata") or {}).get("Data") or {}).get("Git") or {}
+            findings.append(make_finding(
+                "TruffleHog",
+                entry.get("DetectorName", "?"),
+                "VERIFIED" if entry.get("Verified") else "UNVERIFIED",
+                git_meta.get("file", "?"),
+                target=git_meta.get("commit", "-"),
+            ))
+    return findings
+
+
+def sort_findings(findings):
+    return sorted(findings, key=lambda f: (SEVERITY_ORDER.get(f["severity"], 9), f["id"]))
+
+
+def print_summary(findings):
+    if not findings:
+        print("Keine Funde.")
+        return
+    widths = {
+        key: max(len(key), *(len(str(f[key])) for f in findings))
+        for key in ("source", "id", "severity", "package", "installed", "fixed", "target")
+    }
+    header = ("source", "id", "severity", "package", "installed", "fixed", "target")
+    row_fmt = "  ".join(f"{{:{widths[k]}}}" for k in header)
+    print(row_fmt.format(*header))
+    print(row_fmt.format(*("-" * widths[k] for k in header)))
+    for f in findings:
+        print(row_fmt.format(*(str(f[k]) for k in header)))
+
+
+TRUFFLEHOG_GUIDANCE = """### Vorgehen bei gefundenen Secrets
+
+1. **Sofort rotieren/widerrufen**: Das betroffene Secret (Token, Passwort, Schlüssel) beim jeweiligen Dienst ungültig machen und durch ein neues ersetzen. Ein einmal committetes Secret gilt als kompromittiert, auch wenn es später aus der Historie entfernt wird.
+2. **Ursache beheben**: Neues Secret nur noch über Umgebungsvariablen/Secrets-Store einbinden, nicht erneut hart codieren.
+3. **Historie bereinigen (optional, manuell, erst nach Schritt 1)**: Mit `git filter-repo` oder BFG Repo-Cleaner den Commit-Inhalt entfernen, danach `git push --force` in Absprache mit allen Mitwirkenden – bestehende Clones/Forks werden dadurch ungültig.
+4. **Issue schließen**, sobald rotiert wurde. TruffleHog findet das alte Secret ggf. weiterhin in der Historie – nach der Rotation ist das unkritisch.
+
+> Der Wert des Secrets selbst wird hier bewusst nicht ausgegeben, auch nicht gekürzt – nur Detector, Datei und Commit. Fund lässt sich über "Ziel" (Commit-Hash) und "Paket" (Dateipfad) lokalisieren."""
+
+
+def escape_md_cell(value):
+    return str(value).replace("|", "\\|").replace("\r", " ").replace("\n", " ")
+
+
+def build_report(findings, run_url):
+    lines = [
+        "Automatisch erstellt vom Security-Scan-Workflow.",
+        f"Lauf: {run_url}" if run_url else "",
+        "",
+        "| Quelle | ID | Schweregrad | Paket | Installiert | Fix | Ziel |",
+        "|---|---|---|---|---|---|---|",
+    ]
+    for f in findings:
+        cells = (f["source"], f["id"], f["severity"], f["package"], f["installed"], f["fixed"], f["target"])
+        lines.append("| " + " | ".join(escape_md_cell(c) for c in cells) + " |")
+    if any(f["source"] == "TruffleHog" for f in findings):
+        lines.append("")
+        lines.append(TRUFFLEHOG_GUIDANCE)
+    return "\n".join(lines)
+
+
+def ensure_label(token, gitea_url, repo):
+    page = 1
+    while True:
+        labels = api("GET", f"/repos/{repo}/labels?limit=50&page={page}", token, gitea_url) or []
+        for label in labels:
+            if label.get("name") == LABEL_NAME:
+                return label["id"]
+        if len(labels) < 50:
+            break
+        page += 1
+    created = api("POST", f"/repos/{repo}/labels", token, gitea_url, {
+        "name": LABEL_NAME,
+        "color": LABEL_COLOR,
+        "description": "Automatisch verwaltet vom Security-Scan-Workflow",
+    })
+    return created["id"]
+
+
+def find_open_issue(token, gitea_url, repo):
+    issues = api(
+        "GET",
+        f"/repos/{repo}/issues?state=open&type=issues&labels={LABEL_NAME}",
+        token,
+        gitea_url,
+    ) or []
+    for issue in issues:
+        if issue.get("title") == ISSUE_TITLE:
+            return issue
+    return None
+
+
+def main():
+    trivy_path = sys.argv[1] if len(sys.argv) > 1 else None
+    osv_path = sys.argv[2] if len(sys.argv) > 2 else None
+    trufflehog_path = sys.argv[3] if len(sys.argv) > 3 else None
+
+    gitea_url = os.environ.get("GITEA_URL", "").strip().rstrip("/")
+    repo = os.environ.get("REPO", "").strip()
+    token = os.environ.get("TOKEN", "").strip()
+    run_url = os.environ.get("RUN_URL", "")
+    osv_exit = int(os.environ.get("OSV_EXIT", "0"))
+    trufflehog_exit = int(os.environ.get("TRUFFLEHOG_EXIT", "0"))
+
+    findings = sort_findings(load_trivy(trivy_path) + load_osv(osv_path) + load_trufflehog(trufflehog_path))
+    print_summary(findings)
+
+    if not token or not gitea_url or not repo:
+        missing = [name for name, val in [("TOKEN", token), ("GITEA_URL", gitea_url), ("REPO", repo)] if not val]
+        print(f"{', '.join(missing)} nicht gesetzt oder leer – überspringe Gitea-Issue-Synchronisation.")
+    else:
+        open_issue = find_open_issue(token, gitea_url, repo)
+
+        if findings:
+            report = build_report(findings, run_url)
+            if open_issue:
+                print(f"Kommentiere bestehendes Issue #{open_issue['number']} mit {len(findings)} Fund(en).")
+                api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {"body": report})
+            else:
+                label_id = ensure_label(token, gitea_url, repo)
+                print(f"Erstelle neues Issue mit {len(findings)} Fund(en).")
+                api("POST", f"/repos/{repo}/issues", token, gitea_url, {
+                    "title": ISSUE_TITLE,
+                    "body": report,
+                    "labels": [label_id],
+                })
+        elif open_issue:
+            print(f"Keine aktuellen Funde mehr. Kommentiere Issue #{open_issue['number']}.")
+            api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {
+                "body": f"Aktueller Scan hat keine offenen Schwachstellen mehr gefunden.\n\n{run_url}".strip(),
+            })
+        else:
+            print("Keine Funde und kein offenes Issue vorhanden.")
+
+    osv_ok_exits = {0, 1}
+    trufflehog_ok_exits = {0, 183}
+    if osv_exit not in osv_ok_exits:
+        print(f"WARNUNG: osv-scanner beendete sich mit unerwartetem Exit-Code {osv_exit} - Scan evtl. unvollständig.",
+              file=sys.stderr)
+    if trufflehog_exit not in trufflehog_ok_exits:
+        print(
+            f"WARNUNG: trufflehog beendete sich mit unerwartetem Exit-Code {trufflehog_exit} - Scan evtl. unvollständig.",
+            file=sys.stderr)
+
+    has_trivy_findings = any(f["source"].startswith("Trivy") for f in findings)
+    if (
+            has_trivy_findings
+            or osv_exit == 1
+            or trufflehog_exit == 183
+            or osv_exit not in osv_ok_exits
+            or trufflehog_exit not in trufflehog_ok_exits
+    ):
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

src/config.rs

@@ -0,0 +1,37 @@
+//! Modul für die Konfigurationsverwaltung der Anwendung.
+//!
+//! Dieses Modul stellt die Datenstrukturen für die Anwendungskonfiguration bereit.
+//! Das Laden, Speichern und Cachen erfolgt über das Crate `config-ctdra`.
+
+use config_ctdra::get_config as get_cached_config;
+use serde::{Deserialize, Serialize};
+
+/// Hauptkonfigurationsstruktur der Anwendung.
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Default)]
+pub struct AppConfig {
+    /// Allgemeine Einstellungen
+    pub general: General,
+}
+
+/// Allgemeine Konfigurationseinstellungen.
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
+pub struct General {
+    /// Log-Level für die Anwendung (error, warn, info, debug)
+    pub log_level: String,
+    /// Pfad zum Verzeichnis mit den Docker-Applikationen
+    pub apps_dir: String,
+}
+
+impl Default for General {
+    fn default() -> Self {
+        Self {
+            log_level: "info".to_string(),
+            apps_dir: "/var/apps".to_string(),
+        }
+    }
+}
+
+/// Gibt die globale Konfiguration zurück.
+pub fn get_config() -> &'static AppConfig {
+    get_cached_config::<AppConfig>()
+}

src/lib.rs

@@ -0,0 +1,4 @@
+//! DockerUpdate Bibliotheksexporte
+
+pub mod config;
+pub mod updater;

src/main.rs

@@ -0,0 +1,31 @@
+use docker_update::config::get_config;
+use docker_update::updater;
+use logger_ctdra::{LogLevel, log};
+use std::process::exit;
+use sudo_ctdra::{is_run_as_root, run_as_root};
+
+fn main() {
+    if !is_run_as_root() {
+        log(
+            "auth",
+            "Root-Rechte erforderlich. Starte mit sudo neu...",
+            LogLevel::Info,
+        );
+        let err = run_as_root();
+        log(
+            "auth",
+            &format!("Fehler beim Ausführen von 'sudo': {}", err),
+            LogLevel::Error,
+        );
+        exit(1);
+    }
+
+    let config = get_config();
+    if let Ok(level) = LogLevel::try_from(config.general.log_level.as_str()) {
+        logger_ctdra::init(level);
+    }
+
+    log("main", "docker-update gestartet.", LogLevel::Info);
+    updater::run_updates();
+    log("main", "docker-update beendet.", LogLevel::Info);
+}

src/updater.rs

@@ -0,0 +1,412 @@
+use crate::config;
+use logger_ctdra::{LogLevel, log};
+use serde::Deserialize;
+use std::collections::HashMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+const COMPOSE_FILENAMES: &[&str] = &[
+    "docker-compose.yaml",
+    "docker-compose.yml",
+    "compose.yaml",
+    "compose.yml",
+];
+
+#[derive(Debug, Deserialize)]
+struct ComposeFile {
+    #[serde(default)]
+    services: HashMap<String, ServiceConfig>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ServiceConfig {
+    #[serde(default)]
+    image: Option<String>,
+}
+
+/// Prüft, ob ein Image-Tag auf `:latest` zeigt (oder implizit `:latest` ist, weil kein Tag angegeben wurde).
+pub fn is_latest_image(image: &str) -> bool {
+    let image = image.trim();
+    if image.is_empty() {
+        return false;
+    }
+    // Wenn das Image an einen Digest gepinnt ist (z. B. image@sha256:...), ist es kein dynamisches latest-Tag.
+    if image.contains('@') {
+        return false;
+    }
+    // Den Tag-Teil nach dem letzten Schrägstrich ermitteln (um Host:Port/Repo nicht fälschlich als Tag zu werten)
+    let repo_and_tag = image.rsplit('/').next().unwrap_or(image);
+    if let Some((_, tag)) = repo_and_tag.split_once(':') {
+        tag.eq_ignore_ascii_case("latest")
+    } else {
+        // Kein Tag angegeben bedeutet bei Docker implizit `:latest`
+        true
+    }
+}
+
+/// Sucht in einem Verzeichnis nach einer gültigen Docker-Compose-Datei.
+pub fn find_compose_file(dir: &Path) -> Option<PathBuf> {
+    for filename in COMPOSE_FILENAMES {
+        let path = dir.join(filename);
+        if path.is_file() {
+            return Some(path);
+        }
+    }
+    None
+}
+
+/// Liest eine Compose-Datei ein und liefert eine Liste von (Service-Name, Image-Name).
+pub fn parse_compose_services(compose_path: &Path) -> Result<Vec<(String, String)>, String> {
+    let content = fs::read_to_string(compose_path).map_err(|e| {
+        format!(
+            "Fehler beim Lesen der Datei '{}': {}",
+            compose_path.display(),
+            e
+        )
+    })?;
+
+    let compose: ComposeFile = serde_saphyr::from_str(&content).map_err(|e| {
+        format!(
+            "Fehler beim Parsen der YAML-Datei '{}': {}",
+            compose_path.display(),
+            e
+        )
+    })?;
+
+    let mut services = Vec::new();
+    for (service_name, config) in compose.services {
+        if let Some(image) = config.image {
+            let image = image.trim().to_string();
+            if !image.is_empty() {
+                services.push((service_name, image));
+            }
+        }
+    }
+
+    Ok(services)
+}
+
+/// Führt einen Docker-Befehl aus und liefert die Ausgabe.
+fn run_docker_command(args: &[&str]) -> std::io::Result<Output> {
+    Command::new("docker").args(args).output()
+}
+
+/// Führt einen Docker-Compose-Befehl im angegebenen Verzeichnis aus.
+/// Versucht zuerst `docker compose` und fällt bei Nichtverfügbarkeit auf `docker-compose` zurück.
+pub fn run_compose_command(dir: &Path, args: &[&str]) -> std::io::Result<Output> {
+    let mut compose_args = vec!["compose"];
+    compose_args.extend_from_slice(args);
+
+    let output = Command::new("docker")
+        .current_dir(dir)
+        .args(&compose_args)
+        .output();
+
+    match output {
+        Ok(out) => {
+            let stderr = String::from_utf8_lossy(&out.stderr);
+            let is_unavailable = !out.status.success()
+                && (stderr.contains("is not a docker command")
+                    || stderr.contains("unknown command \"compose\"")
+                    || stderr.contains("unknown command: compose"));
+
+            if is_unavailable
+                && let Ok(fallback_out) = Command::new("docker-compose")
+                    .current_dir(dir)
+                    .args(args)
+                    .output()
+            {
+                return Ok(fallback_out);
+            }
+            Ok(out)
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            // docker-Binary nicht gefunden, versuche docker-compose
+            Command::new("docker-compose")
+                .current_dir(dir)
+                .args(args)
+                .output()
+        }
+        Err(err) => Err(err),
+    }
+}
+
+/// Ermittelt die lokale Image-ID für ein gegebenes Docker-Image.
+pub fn get_local_image_id(image: &str) -> Option<String> {
+    let output = run_docker_command(&["image", "inspect", "--format", "{{.Id}}", image]).ok()?;
+    if output.status.success() {
+        let id = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        if !id.is_empty() {
+            return Some(id);
+        }
+    }
+    None
+}
+
+/// Zieht ein Docker-Image herunter und gibt zurück, ob ein neueres Image heruntergeladen wurde.
+pub fn pull_image(image: &str) -> Result<bool, String> {
+    let old_id = get_local_image_id(image);
+
+    let output = run_docker_command(&["pull", image])
+        .map_err(|e| format!("Fehler beim Ausführen von 'docker pull {}': {}", image, e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        return Err(format!(
+            "'docker pull {}' fehlgeschlagen: {}",
+            image, stderr
+        ));
+    }
+
+    let stdout_str = String::from_utf8_lossy(&output.stdout);
+    let new_id = get_local_image_id(image);
+
+    let updated = match (&old_id, &new_id) {
+        (Some(old), Some(new)) => old != new,
+        (None, Some(_)) => true,
+        _ => stdout_str.contains("Downloaded newer image") || stdout_str.contains("Pull complete"),
+    };
+
+    Ok(updated)
+}
+
+/// Aktualisiert und startet die Docker-Compose-Services im angegebenen Verzeichnis neu.
+pub fn restart_compose_service(dir: &Path, service_name: Option<&str>) -> Result<(), String> {
+    let mut args = vec!["up", "-d"];
+    if let Some(service) = service_name {
+        args.push(service);
+    }
+
+    let output = run_compose_command(dir, &args)
+        .map_err(|e| format!("Fehler beim Ausführen von 'docker compose up -d': {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        return Err(format!("Neustart fehlgeschlagen: {}", stderr));
+    }
+
+    Ok(())
+}
+
+/// Bereinigt ungenutzte Zwischen-Images via `docker image prune -f`.
+pub fn prune_images() -> Result<(), String> {
+    let output = run_docker_command(&["image", "prune", "-f"])
+        .map_err(|e| format!("Fehler beim Ausführen von 'docker image prune -f': {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        return Err(format!(
+            "'docker image prune -f' fehlgeschlagen: {}",
+            stderr
+        ));
+    }
+
+    Ok(())
+}
+
+/// Prüft alle Unterverzeichnisse im konfigurierten Apps-Verzeichnis auf Aktualisierungen.
+pub fn run_updates() {
+    let config = config::get_config();
+    let apps_dir_path = Path::new(&config.general.apps_dir);
+
+    log(
+        "scanner",
+        &format!(
+            "Überprüfe Anwendungsverzeichnis: {}",
+            apps_dir_path.display()
+        ),
+        LogLevel::Info,
+    );
+
+    if !apps_dir_path.exists() {
+        log(
+            "scanner",
+            &format!("Verzeichnis '{}' existiert nicht.", apps_dir_path.display()),
+            LogLevel::Warn,
+        );
+        return;
+    }
+
+    let entries = match fs::read_dir(apps_dir_path) {
+        Ok(e) => e,
+        Err(e) => {
+            log(
+                "scanner",
+                &format!("Fehler beim Lesen von '{}': {}", apps_dir_path.display(), e),
+                LogLevel::Error,
+            );
+            return;
+        }
+    };
+
+    let mut app_dirs: Vec<PathBuf> = entries
+        .filter_map(|res| res.ok().map(|e| e.path()))
+        .filter(|p| p.is_dir())
+        .collect();
+
+    app_dirs.sort();
+
+    if app_dirs.is_empty() {
+        log(
+            "scanner",
+            &format!(
+                "Keine Unterverzeichnisse in '{}' gefunden.",
+                apps_dir_path.display()
+            ),
+            LogLevel::Info,
+        );
+        return;
+    }
+
+    for app_dir in app_dirs {
+        let app_name = app_dir.file_name().unwrap_or_default().to_string_lossy();
+        log(
+            "scanner",
+            &format!("Untersuche Anwendung '{}'...", app_name),
+            LogLevel::Info,
+        );
+
+        let compose_file = match find_compose_file(&app_dir) {
+            Some(f) => f,
+            None => {
+                log(
+                    "scanner",
+                    &format!(
+                        "Keine Docker-Compose-Datei in '{}' gefunden. Überspringe.",
+                        app_dir.display()
+                    ),
+                    LogLevel::Debug,
+                );
+                continue;
+            }
+        };
+
+        log(
+            "compose",
+            &format!("Gefundene Compose-Datei: {}", compose_file.display()),
+            LogLevel::Debug,
+        );
+
+        let services = match parse_compose_services(&compose_file) {
+            Ok(s) => s,
+            Err(e) => {
+                log(
+                    "compose",
+                    &format!(
+                        "Fehler beim Analysieren von '{}': {}",
+                        compose_file.display(),
+                        e
+                    ),
+                    LogLevel::Warn,
+                );
+                continue;
+            }
+        };
+
+        let mut updated_any = false;
+
+        for (service_name, image) in services {
+            if !is_latest_image(&image) {
+                log(
+                    "updater",
+                    &format!(
+                        "Service '{}' verwendet kein :latest-Image ('{}'). Überspringe.",
+                        service_name, image
+                    ),
+                    LogLevel::Debug,
+                );
+                continue;
+            }
+
+            log(
+                "updater",
+                &format!(
+                    "Prüfe auf neues Image für Service '{}' ('{}')...",
+                    service_name, image
+                ),
+                LogLevel::Info,
+            );
+
+            match pull_image(&image) {
+                Ok(true) => {
+                    log(
+                        "updater",
+                        &format!(
+                            "Neueres Image für Service '{}' ('{}') gefunden und heruntergeladen.",
+                            service_name, image
+                        ),
+                        LogLevel::Info,
+                    );
+                    updated_any = true;
+                }
+                Ok(false) => {
+                    log(
+                        "updater",
+                        &format!(
+                            "Image für Service '{}' ('{}') ist bereits aktuell.",
+                            service_name, image
+                        ),
+                        LogLevel::Info,
+                    );
+                }
+                Err(e) => {
+                    log(
+                        "updater",
+                        &format!("Fehler beim Aktualisieren von Image '{}': {}", image, e),
+                        LogLevel::Error,
+                    );
+                }
+            }
+        }
+
+        if updated_any {
+            log(
+                "updater",
+                &format!(
+                    "Starte Anwendung '{}' neu mit aktualisierten Images...",
+                    app_name
+                ),
+                LogLevel::Info,
+            );
+            match restart_compose_service(&app_dir, None) {
+                Ok(_) => {
+                    log(
+                        "updater",
+                        &format!(
+                            "Anwendung '{}' erfolgreich aktualisiert und neu gestartet.",
+                            app_name
+                        ),
+                        LogLevel::Info,
+                    );
+                }
+                Err(e) => {
+                    log(
+                        "updater",
+                        &format!("Fehler beim Neustarten der Anwendung '{}': {}", app_name, e),
+                        LogLevel::Error,
+                    );
+                }
+            }
+
+            log(
+                "updater",
+                "Bereinige ungenutzte Docker-Images...",
+                LogLevel::Info,
+            );
+            if let Err(e) = prune_images() {
+                log(
+                    "updater",
+                    &format!("Fehler beim Bereinigen ungenutzter Docker-Images: {}", e),
+                    LogLevel::Warn,
+                );
+            }
+        }
+    }
+
+    log(
+        "scanner",
+        "Aktualisierungsvorgang abgeschlossen.",
+        LogLevel::Info,
+    );
+}

tests/config.rs

@@ -0,0 +1,8 @@
+use docker_update::config::AppConfig;
+
+#[test]
+fn test_default_config() {
+    let config = AppConfig::default();
+    assert_eq!(config.general.apps_dir, "/var/apps");
+    assert_eq!(config.general.log_level, "info");
+}

tests/updater.rs

@@ -0,0 +1,68 @@
+use docker_update::updater::{find_compose_file, is_latest_image, parse_compose_services};
+use std::fs::{self, File};
+use std::io::Write;
+
+#[test]
+fn test_is_latest_image() {
+    assert!(is_latest_image("nginx"));
+    assert!(is_latest_image("nginx:latest"));
+    assert!(is_latest_image("nginx:LATEST"));
+    assert!(is_latest_image("gitea/gitea"));
+    assert!(is_latest_image("gitea/gitea:latest"));
+    assert!(is_latest_image("localhost:5000/my-app"));
+    assert!(is_latest_image("localhost:5000/my-app:latest"));
+
+    assert!(!is_latest_image("nginx:alpine"));
+    assert!(!is_latest_image("gitea/gitea:1.20"));
+    assert!(!is_latest_image("postgres:15-alpine"));
+    assert!(!is_latest_image("localhost:5000/my-app:v1.0"));
+    assert!(!is_latest_image("nginx@sha256:1234567890abcdef"));
+    assert!(!is_latest_image(""));
+}
+
+#[test]
+fn test_parse_compose_services() {
+    let temp_dir = std::env::temp_dir().join("docker_update_test_compose");
+    let _ = fs::create_dir_all(&temp_dir);
+    let compose_path = temp_dir.join("docker-compose.yaml");
+
+    let yaml_content = r#"
+services:
+  gitea:
+    image: gitea/gitea:latest
+    ports:
+      - "3000:3000"
+  db:
+    image: postgres:15
+    environment:
+      POSTGRES_DB: gitea
+"#;
+    let mut file = File::create(&compose_path).unwrap();
+    file.write_all(yaml_content.as_bytes()).unwrap();
+
+    let services = parse_compose_services(&compose_path).unwrap();
+    assert_eq!(services.len(), 2);
+
+    let gitea_svc = services.iter().find(|(s, _)| s == "gitea").unwrap();
+    assert_eq!(gitea_svc.1, "gitea/gitea:latest");
+
+    let db_svc = services.iter().find(|(s, _)| s == "db").unwrap();
+    assert_eq!(db_svc.1, "postgres:15");
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[test]
+fn test_find_compose_file() {
+    let temp_dir = std::env::temp_dir().join("docker_update_test_find");
+    let _ = fs::create_dir_all(&temp_dir);
+
+    assert_eq!(find_compose_file(&temp_dir), None);
+
+    let compose_path = temp_dir.join("docker-compose.yaml");
+    File::create(&compose_path).unwrap();
+
+    assert_eq!(find_compose_file(&temp_dir), Some(compose_path));
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}