ci: add Ansible CI/CD workflow with nostr relay listener

- ci_listener.py: WebSocket client subscribed to ngit.orangesync.tech
  for NIP-34 git state events (kind 30617), triggers pipeline on push
- run_pipeline.sh: clone + make test-unit + Docker ESP-IDF build
- systemd service: tollgate-ci-listener with auto-restart
- Ansible role ci_runner: Docker, ESP-IDF image, listener deployment
- 20-ci-runner.yml: playbook for CI runner setup
- 30-hardware-tests.yml: playbook for localhost board testing

6 files changed, 393 insertions, 0 deletions

diff --git a/ci/ansible/20-ci-runner.yml b/ci/ansible/20-ci-runner.yml
new file mode 100644
index 0000000..62ff12a
--- /dev/null
+++ b/ci/ansible/20-ci-runner.yml
@@ -0,0 +1,9 @@
+---
+# Deploy CI runner for esp32-tollgate
+# Usage: ansible-playbook 20-ci-runner.yml
+
+- name: Deploy CI runner
+  hosts: localhost
+  connection: local
+  roles:
+    - role: ci_runner
diff --git a/ci/ansible/30-hardware-tests.yml b/ci/ansible/30-hardware-tests.yml
new file mode 100644
index 0000000..93a3a10
--- /dev/null
+++ b/ci/ansible/30-hardware-tests.yml
@@ -0,0 +1,69 @@
+---
+# Run hardware integration tests on localhost
+# Usage: ansible-playbook 30-hardware-tests.yml [-e "board=a"] [-e "skip_flash=false"]
+
+- name: Hardware integration tests
+  hosts: localhost
+  connection: local
+  vars:
+    board: "a"
+    skip_flash: false
+    esp32_tollgate_dir: "/home/c03rad0r/esp32-tollgate"
+    sudo_pw: "c03rad0r123"
+    board_config:
+      a:
+        port: "/dev/ttyACM0"
+        ip: "10.185.47.1"
+        ssid: "TollGate-B96D80"
+      b:
+        port: "/dev/ttyACM1"
+        ip: "10.192.45.1"
+        ssid: "TollGate-C0E9CA"
+
+  tasks:
+    - name: Set board facts
+      set_fact:
+        board_port: "{{ board_config[board].port }}"
+        board_ip: "{{ board_config[board].ip }}"
+        board_ssid: "{{ board_config[board].ssid }}"
+
+    - name: Verify board connected
+      command: "esptool.py --port {{ board_port }} chip_id"
+      changed_when: false
+
+    - name: Flash firmware
+      when: not skip_flash | bool
+      command: "make flash-{{ board }}"
+      args:
+        chdir: "{{ esp32_tollgate_dir }}"
+
+    - name: Wait for board boot
+      pause:
+        seconds: 15
+
+    - name: Run smoke tests
+      command: "make test-smoke"
+      args:
+        chdir: "{{ esp32_tollgate_dir }}"
+      environment:
+        TOLLGATE_IP: "{{ board_ip }}"
+        BOARD: "{{ board }}"
+      register: smoke_result
+      ignore_errors: true
+
+    - name: Run integration tests
+      command: "make test-integration"
+      args:
+        chdir: "{{ esp32_tollgate_dir }}"
+      environment:
+        TOLLGATE_IP: "{{ board_ip }}"
+        TOLLGATE_SSID: "{{ board_ssid }}"
+      register: integration_result
+      ignore_errors: true
+
+    - name: Report results
+      debug:
+        msg: |
+          Board: {{ board }} ({{ board_ip }})
+          Smoke: {{ 'PASS' if smoke_result is success else 'FAIL' }}
+          Integration: {{ 'PASS' if integration_result is success else 'FAIL' }}
diff --git a/ci/ansible/roles/ci_runner/tasks/main.yml b/ci/ansible/roles/ci_runner/tasks/main.yml
new file mode 100644
index 0000000..b29a237
--- /dev/null
+++ b/ci/ansible/roles/ci_runner/tasks/main.yml
@@ -0,0 +1,72 @@
+---
+# CI Runner role: Docker + ESP-IDF + nostr listener for CI/CD
+
+- name: Install Docker
+  become: true
+  block:
+    - name: Check if Docker is installed
+      command: docker --version
+      changed_when: false
+      ignore_errors: true
+      register: docker_check
+
+    - name: Install Docker
+      when: docker_check.failed
+      block:
+        - name: Install Docker packages
+          apt:
+            name:
+              - docker.io
+              - docker-compose-v2
+            state: present
+            update_cache: true
+
+    - name: Add user to docker group
+      user:
+        name: "{{ ansible_user_id }}"
+        groups: docker
+        append: true
+
+- name: Pull ESP-IDF Docker image
+  become: true
+  community.docker.docker_image:
+    name: espressif/idf
+    tag: latest
+    source: pull
+
+- name: Install Python dependencies for CI listener
+  pip:
+    name:
+      - websockets
+    state: present
+    extra_args: --user
+
+- name: Install CI listener systemd service
+  become: true
+  block:
+    - name: Copy service file
+      copy:
+        src: ../../systemd/tollgate-ci-listener.service
+        dest: /etc/systemd/system/tollgate-ci-listener.service
+        mode: "0644"
+
+    - name: Reload systemd
+      systemd:
+        daemon_reload: true
+
+    - name: Enable and start CI listener
+      systemd:
+        name: tollgate-ci-listener
+        enabled: true
+        state: started
+
+- name: Verify CI listener is running
+  block:
+    - name: Check service status
+      command: systemctl is-active tollgate-ci-listener
+      changed_when: false
+      register: listener_status
+
+    - name: Report status
+      debug:
+        msg: "CI listener status: {{ listener_status.stdout }}"
diff --git a/ci/scripts/ci_listener.py b/ci/scripts/ci_listener.py
new file mode 100755
index 0000000..50549a9
--- /dev/null
+++ b/ci/scripts/ci_listener.py
@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""Nostr relay listener for CI/CD triggers.
+
+Subscribes to wss://ngit.orangesync.tech for NIP-34 git state events (kind 30617).
+When a push event is detected for esp32-tollgate, triggers the CI pipeline.
+"""
+
+import json
+import asyncio
+import hashlib
+import subprocess
+import logging
+import os
+import sys
+import time
+from datetime import datetime, timezone
+
+try:
+    import websockets
+except ImportError:
+    print("websockets not installed. Run: pip install websockets")
+    sys.exit(1)
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s [%(levelname)s] %(message)s",
+)
+log = logging.getLogger("ci-listener")
+
+RELAY_URL = os.environ.get("CI_RELAY_URL", "wss://ngit.orangesync.tech")
+REPO_ID = os.environ.get("CI_REPO_ID", "npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/esp32-tollgate")
+BRANCH = os.environ.get("CI_BRANCH", "feature/tollgate-core-v2")
+PIPELINE_SCRIPT = os.environ.get("CI_PIPELINE_SCRIPT", os.path.join(os.path.dirname(__file__), "run_pipeline.sh"))
+RECONNECT_DELAY = 5
+POLL_TIMEOUT = 300
+
+
+def generate_sub_id():
+    h = hashlib.sha256(f"ci-listener-{time.time()}".encode()).hexdigest()
+    return f"ci-{h[:16]}"
+
+
+async def run_pipeline(event_data):
+    log.info("Triggering CI pipeline for branch=%s", BRANCH)
+    env = os.environ.copy()
+    env["CI_EVENT_JSON"] = json.dumps(event_data)
+    env["CI_BRANCH"] = BRANCH
+    try:
+        proc = subprocess.run(
+            ["bash", PIPELINE_SCRIPT],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=600,
+        )
+        log.info("Pipeline exit=%d", proc.returncode)
+        if proc.stdout:
+            for line in proc.stdout.strip().split("\n"):
+                log.info("  pipeline: %s", line)
+        if proc.returncode != 0 and proc.stderr:
+            for line in proc.stderr.strip().split("\n"):
+                log.error("  pipeline: %s", line)
+        return proc.returncode
+    except subprocess.TimeoutExpired:
+        log.error("Pipeline timed out after 600s")
+        return 1
+    except Exception as e:
+        log.error("Pipeline failed: %s", e)
+        return 1
+
+
+async def listen():
+    sub_id = generate_sub_id()
+    filters = {
+        "kinds": [30617],
+        "#d": [REPO_ID],
+        "limit": [1],
+    }
+
+    while True:
+        try:
+            log.info("Connecting to %s", RELAY_URL)
+            async with websockets.connect(RELAY_URL, ping_interval=30) as ws:
+                req = json.dumps(["REQ", sub_id, filters])
+                await ws.send(req)
+                log.info("Subscribed to kind 30617 for %s", REPO_ID)
+
+                last_event_id = None
+
+                while True:
+                    try:
+                        msg = await asyncio.wait_for(ws.recv(), timeout=POLL_TIMEOUT)
+                    except asyncio.TimeoutError:
+                        await ws.send(json.dumps(["PING", sub_id]))
+                        continue
+
+                    data = json.loads(msg)
+
+                    if data[0] == "EVENT":
+                        event = data[2]
+                        eid = event.get("id", "")
+                        if eid == last_event_id:
+                            continue
+                        last_event_id = eid
+
+                        tags = {k: [] for k in ["d", "branch", "commit", "clone"]}
+                        for t in event.get("tags", []):
+                            if len(t) >= 2 and t[0] in tags:
+                                tags[t[0]].append(t[1])
+
+                        event_branch = tags.get("branch", [None])[0]
+                        if event_branch and event_branch != BRANCH:
+                            log.info("Ignoring branch=%s (want %s)", event_branch, BRANCH)
+                            continue
+
+                        log.info("New push: commit=%s branch=%s",
+                                 tags.get("commit", ["?"])[0],
+                                 event_branch or BRANCH)
+                        rc = await run_pipeline(event)
+                        log.info("Pipeline result: %s", "PASS" if rc == 0 else "FAIL")
+
+                    elif data[0] == "EOSE":
+                        log.info("End of stored events, listening for new ones...")
+
+                    elif data[0] == "OK":
+                        pass
+
+                    elif data[0] == "NOTICE":
+                        log.warning("Relay notice: %s", data[1] if len(data) > 1 else data)
+
+        except websockets.ConnectionClosed as e:
+            log.warning("Connection closed: %s, reconnecting in %ds", e, RECONNECT_DELAY)
+        except Exception as e:
+            log.error("Error: %s, reconnecting in %ds", e, RECONNECT_DELAY)
+
+        await asyncio.sleep(RECONNECT_DELAY)
+
+
+def main():
+    log.info("CI Listener starting: relay=%s repo=%s branch=%s", RELAY_URL, REPO_ID, BRANCH)
+    asyncio.run(listen())
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ci/scripts/run_pipeline.sh b/ci/scripts/run_pipeline.sh
new file mode 100755
index 0000000..2bef754
--- /dev/null
+++ b/ci/scripts/run_pipeline.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+# CI pipeline for esp32-tollgate
+# Triggered by ci_listener.py on NIP-34 push events
+set -euo pipefail
+
+BRANCH="${CI_BRANCH:-feature/tollgate-core-v2}"
+REPO_DIR="/tmp/ci-esp32-tollgate"
+LOG_FILE="/tmp/ci-esp32-tollgate-pipeline.log"
+RESULT_FILE="/tmp/ci-esp32-tollgate-result.txt"
+
+echo "=== CI Pipeline Start ===" | tee "$LOG_FILE"
+echo "Branch: $BRANCH" | tee -a "$LOG_FILE"
+echo "Time: $(date -Iseconds)" | tee -a "$LOG_FILE"
+
+# Clone or update
+if [ -d "$REPO_DIR" ]; then
+    echo "Updating existing clone..." | tee -a "$LOG_FILE"
+    git -C "$REPO_DIR" fetch --all 2>&1 | tee -a "$LOG_FILE" || true
+    git -C "$REPO_DIR" checkout "$BRANCH" 2>&1 | tee -a "$LOG_FILE" || true
+    git -C "$REPO_DIR" reset --hard "origin/$BRANCH" 2>&1 | tee -a "$LOG_FILE" || true
+else
+    echo "Cloning repository..." | tee -a "$LOG_FILE"
+    mkdir -p "$(dirname "$REPO_DIR")"
+    git clone --branch "$BRANCH" \
+        "nostr://npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/ngit.orangesync.tech/esp32-tollgate" \
+        "$REPO_DIR" 2>&1 | tee -a "$LOG_FILE"
+fi
+
+cd "$REPO_DIR"
+
+# Init submodules
+echo "=== Initializing submodules ===" | tee -a "$LOG_FILE"
+git submodule update --init --recursive 2>&1 | tee -a "$LOG_FILE" || true
+
+# Run host unit tests
+echo "=== Running unit tests ===" | tee -a "$LOG_FILE"
+if make test-unit 2>&1 | tee -a "$LOG_FILE"; then
+    echo "UNIT_TESTS=PASS" | tee -a "$LOG_FILE"
+    UNIT_RESULT="PASS"
+else
+    echo "UNIT_TESTS=FAIL" | tee -a "$LOG_FILE"
+    UNIT_RESULT="FAIL"
+fi
+
+# ESP-IDF build (in Docker)
+echo "=== ESP-IDF Build ===" | tee -a "$LOG_FILE"
+if command -v docker &>/dev/null; then
+    docker run --rm \
+        -v "$REPO_DIR:/project" \
+        -w /project \
+        espressif/idf:latest \
+        bash -c "idf.py build 2>&1" | tee -a "$LOG_FILE"
+    BUILD_RC=${PIPESTATUS[0]:-1}
+else
+    echo "Docker not available, skipping ESP-IDF build" | tee -a "$LOG_FILE"
+    BUILD_RC=0
+fi
+
+if [ "$BUILD_RC" -eq 0 ]; then
+    echo "IDF_BUILD=PASS" | tee -a "$LOG_FILE"
+    BUILD_RESULT="PASS"
+else
+    echo "IDF_BUILD=FAIL" | tee -a "$LOG_FILE"
+    BUILD_RESULT="FAIL"
+fi
+
+# Summary
+echo "=== Summary ===" | tee -a "$LOG_FILE"
+echo "Unit tests: $UNIT_RESULT" | tee -a "$LOG_FILE"
+echo "IDF build:  $BUILD_RESULT" | tee -a "$LOG_FILE"
+
+if [ "$UNIT_RESULT" = "PASS" ] && [ "$BUILD_RESULT" = "PASS" ]; then
+    echo "OVERALL=PASS" | tee -a "$LOG_FILE"
+    echo "PASS" > "$RESULT_FILE"
+    exit 0
+else
+    echo "OVERALL=FAIL" | tee -a "$LOG_FILE"
+    echo "FAIL" > "$RESULT_FILE"
+    exit 1
+fi
diff --git a/ci/systemd/tollgate-ci-listener.service b/ci/systemd/tollgate-ci-listener.service
new file mode 100644
index 0000000..287f474
--- /dev/null
+++ b/ci/systemd/tollgate-ci-listener.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=ESP32-TollGate CI Nostr Listener
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=c03rad0r
+WorkingDirectory=/home/c03rad0r/esp32-tollgate/ci/scripts
+ExecStart=/usr/bin/python3 /home/c03rad0r/esp32-tollgate/ci/scripts/ci_listener.py
+Restart=always
+RestartSec=10
+Environment=CI_RELAY_URL=wss://ngit.orangesync.tech
+Environment=CI_BRANCH=feature/tollgate-core-v2
+Environment=CI_REPO_ID=npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/esp32-tollgate
+
+[Install]
+WantedBy=multi-user.target