chore(ci): add Woodpecker secrets for Mistral API and JWT configuration

- Update .woodpecker.yml to inject Mistral and JWT secrets as environment variables
- Update docker-compose.yml to pass secrets to backend container
- Secrets are loaded from Woodpecker and passed via environment variables:
  - MISTRAL_APIKEY, MISTRAL_BASEURL, MISTRAL_DEFAULTMODEL, etc.
  - JWT_KEY, JWT_ISSUER, JWT_AUDIENCE, JWT_EXPIREHOURS
- Production deployment will use Woodpecker secrets instead of appsettings files

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

.woodpecker.yml

@@ -65,6 +65,21 @@ steps:
         - docker pull registry.lrhdev.dk/lasserh/deutschlernen-frontend:latest
         - cd /opt/deutschlernen
         - docker compose down
+        # Pass JWT and Mistral configuration as environment variables to docker compose
+        - export Jwt__Key=$JWT_KEY
+        - export Jwt__Issuer=$JWT_ISSUER
+        - export Jwt__Audience=$JWT_AUDIENCE
+        - export Jwt__ExpireHours=$JWT_EXPIREHOURS
+        - export Mistral__ApiKey=$MISTRAL_APIKEY
+        - export Mistral__BaseUrl=$MISTRAL_BASEURL
+        - export Mistral__DefaultModel=$MISTRAL_DEFAULTMODEL
+        - export Mistral__TimeoutSeconds=$MISTRAL_TIMEOUTSECONDS
+        - export Mistral__MaxRetries=$MISTRAL_MAXRETRIES
+        - export Mistral__RateLimitPerMinute=$MISTRAL_RATELIMITPERMINUTE
+        - export Mistral__EnableCaching=$MISTRAL_ENABLECACHING
+        - export Mistral__CacheTTLMinutes=$MISTRAL_CACHETTLMINUTES
+        - export Mistral__CircuitBreakerFailureThreshold=$MISTRAL_CIRCUITBREAKERFAILURETHRESHOLD
+        - export Mistral__CircuitBreakerResetMinutes=$MISTRAL_CIRCUITBREAKERRESETMINUTES
         - docker compose up -d
         - docker image prune -f
     environment:
@@ -72,5 +87,35 @@ steps:
         from_secret: REGISTRY_USERNAME
       REGISTRY_PASSWORD:
         from_secret: REGISTRY_PASSWORD
+      # JWT Configuration - Woodpecker secrets for production
+      JWT_KEY:
+        from_secret: JWT_KEY
+      JWT_ISSUER:
+        from_secret: JWT_ISSUER
+      JWT_AUDIENCE:
+        from_secret: JWT_AUDIENCE
+      JWT_EXPIREHOURS:
+        from_secret: JWT_EXPIREHOURS
+      # Mistral API Configuration - Woodpecker secrets for production
+      MISTRAL_APIKEY:
+        from_secret: MISTRAL_APIKEY
+      MISTRAL_BASEURL:
+        from_secret: MISTRAL_BASEURL
+      MISTRAL_DEFAULTMODEL:
+        from_secret: MISTRAL_DEFAULTMODEL
+      MISTRAL_TIMEOUTSECONDS:
+        from_secret: MISTRAL_TIMEOUTSECONDS
+      MISTRAL_MAXRETRIES:
+        from_secret: MISTRAL_MAXRETRIES
+      MISTRAL_RATELIMITPERMINUTE:
+        from_secret: MISTRAL_RATELIMITPERMINUTE
+      MISTRAL_ENABLECACHING:
+        from_secret: MISTRAL_ENABLECACHING
+      MISTRAL_CACHETTLMINUTES:
+        from_secret: MISTRAL_CACHETTLMINUTES
+      MISTRAL_CIRCUITBREAKERFAILURETHRESHOLD:
+        from_secret: MISTRAL_CIRCUITBREAKERFAILURETHRESHOLD
+      MISTRAL_CIRCUITBREAKERRESETMINUTES:
+        from_secret: MISTRAL_CIRCUITBREAKERRESETMINUTES
     when:
       - branch: main

docker-compose.yml

@@ -28,6 +28,22 @@ services:
       ASPNETCORE_ENVIRONMENT: Development
       ASPNETCORE_URLS: http://+:8080
       ConnectionStrings__DefaultConnection: Host=db;Port=5432;Database=DeutschLernen;Username=postgres;Password=postgres
+      # JWT Configuration (from Woodpecker secrets or environment)
+      Jwt__Key: ${JWT_KEY:-your-super-secret-key-at-least-32-characters-long}
+      Jwt__Issuer: ${JWT_ISSUER:-DeutschLernen}
+      Jwt__Audience: ${JWT_AUDIENCE:-DeutschLernen}
+      Jwt__ExpireHours: ${JWT_EXPIREHOURS:-24}
+      # Mistral API Configuration (from Woodpecker secrets or environment)
+      Mistral__ApiKey: ${MISTRAL_APIKEY:-}
+      Mistral__BaseUrl: ${MISTRAL_BASEURL:-https://api.mistral.ai/v1/}
+      Mistral__DefaultModel: ${MISTRAL_DEFAULTMODEL:-mistral-medium}
+      Mistral__TimeoutSeconds: ${MISTRAL_TIMEOUTSECONDS:-30}
+      Mistral__MaxRetries: ${MISTRAL_MAXRETRIES:-3}
+      Mistral__RateLimitPerMinute: ${MISTRAL_RATELIMITPERMINUTE:-10}
+      Mistral__EnableCaching: ${MISTRAL_ENABLECACHING:-true}
+      Mistral__CacheTTLMinutes: ${MISTRAL_CACHETTLMINUTES:-60}
+      Mistral__CircuitBreakerFailureThreshold: ${MISTRAL_CIRCUITBREAKERFAILURETHRESHOLD:-5}
+      Mistral__CircuitBreakerResetMinutes: ${MISTRAL_CIRCUITBREAKERRESETMINUTES:-1}
     depends_on:
       db:
         condition: service_healthy