- Deploy on push to main and PR validation - SSH deployment to seedbox via Tailscale - Inject secrets from Gitea - Deploy all stacks in stacks/ directory