Secure Self-Hosted DevOps Pipeline

Please begin your proposal with ‘Trinity DevOps’ to show you’ve read the full brief.

I need a private, secure CI/CD pipeline for a Node.js application, running on my Synology NAS (DSM 7.x) and a Hetzner production server.

Requirements:
Code hosted on Gitea (self-hosted Git service on NAS).
Push to Gitea triggers an HMAC-signed webhook to the Hetzner server.
Webhook listener validates the signature and runs deploy.sh:
git pull (from Gitea)
npm install
npm run build
Restart Docker container
Deliver a full, tested, end-to-end deployment pipeline.
Provide clear documentation for setup and maintenance.

Security Measures:
SSH key authentication (no passwords)
Hardened network firewalls
Regular security review/audits

What We Provide:
You will receive the complete project kit, including all necessary scripts and code. Your job is to securely set up, integrate, and test the deployment pipeline on our infrastructure.
Architecture diagram (SVG)
README outline
Test repository
Access to both servers

Bonus Skills:
Docker & Docker Compose
Webhook integration
Secure Linux server deployments

Process:
Shortlisted candidates will receive the full project brief and architecture diagram.