Pin Dokploy deployment URL in workflow

.gitea/workflows/deploy-dokploy.yml

@@ -16,35 +16,17 @@ jobs:
       - name: Upload source and wait for Dokploy build
         shell: bash
         env:
-          DOKPLOY_URL: ${{ secrets.DOKPLOY_URL }}
           DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
           DOKPLOY_APPLICATION_ID: ${{ secrets.DOKPLOY_APPLICATION_ID }}
         run: |
           set -eu
           umask 077
 
-          : "${DOKPLOY_URL:?Add the DOKPLOY_URL Actions secret.}"
+          # Pin the deployment origin; runner variables and .env cannot override it.
+          readonly DOKPLOY_URL='https://dokploy.minegeo.site'
           : "${DOKPLOY_API_KEY:?Add the DOKPLOY_API_KEY Actions secret.}"
           : "${DOKPLOY_APPLICATION_ID:?Add the DOKPLOY_APPLICATION_ID Actions secret.}"
 
-          DOKPLOY_URL="${DOKPLOY_URL%/}"
-          case "$DOKPLOY_URL" in
-            https://*) ;;
-            http://78.153.139.142:3000)
-              echo "::warning::DOKPLOY_URL uses plain HTTP; the API key and source travel unencrypted until a TLS domain is configured."
-              ;;
-            *)
-              echo "DOKPLOY_URL must use HTTPS (or the pinned http://78.153.139.142:3000 until a domain exists)." >&2
-              exit 1
-              ;;
-          esac
-          case "${DOKPLOY_URL#*://}" in
-            */*|*\?*|*\#*|*@*)
-              echo "DOKPLOY_URL must be the HTTPS origin only, without a path or credentials." >&2
-              exit 1
-              ;;
-          esac
-
           temp_root="${RUNNER_TEMP:-/tmp}"
           mkdir -p "$temp_root"
           auth_file="$(mktemp "$temp_root/minegeo-dokploy-auth.XXXXXX")"