fixed test

.gitea/ACTIONS-README.md

@@ -131,11 +131,43 @@ Use a one-shot *registration stack* (deploy it, wait for logs, then remove it) a
      - `REGISTRATION_TOKEN` = *your token* (or use a temporary secret and modify command to read it)
    - Check service logs for success, then remove this stack.
 
-3) **Deploy daemon (global on workers)** — Stack: `.gitea/act-runner-deploy-stack.yml`
+3) **Deploy daemon (global on workers)** — Stack: `.gitea/act-runner-deploy-stack.yml` or `gitea-stack-secured.yml`
    - Ensure secret `registration_token` exists (see step 1).
-   - Deploy stack and set `INSTANCE_URL` and `RUNNER_NAME` as environment variables in Portainer.
-   - Runner will start as a global service on workers and use `/run/secrets/registration_token` (no token stored in repo).
+   - Deploy the secure stack (`gitea-stack-secured.yml`) which references the `registration_token` secret and applies Traefik TCP IP whitelist for SSH.
+   - Important: the `act_runner` service sets `GITEA_RUNNER_LABELS=swarm-runner,self-hosted` so runners register with the `swarm-runner` label used by workflows. If you already had runners registered, redeploying the stack *should* update labels; if labels don't appear, re-register the runner (see steps below).
+   - Deploy stack via Portainer and set `INSTANCE_URL` and `RUNNER_NAME` as environment variables in Portainer if needed.
+   - Runner will start as a global service on workers and read the token from `/run/secrets/registration_token` (no token stored in repo).
+
+---
+
+### If labels do not update after redeploy
+1. Check current runner labels in Gitea UI: **Settings → Actions → Runners**. If `swarm-runner` is missing, re-register the runner to apply labels:
+   - One-shot register stack (Portainer stack or docker run) with `--labels "swarm-runner,self-hosted"` or set `GITEA_RUNNER_LABELS` before registration.
+2. Alternatively, remove the existing `.runner` file from the `act_runner-data` volume and restart the service so it re-registers using the environment labels:
+   ```bash
+   docker run --rm -v act_runner-data:/data alpine sh -c "rm -f /data/.runner && echo removed"
+   # then redeploy stack
+   docker stack deploy -c gitea-stack-secured.yml gitea
+   ```
+3. After re-registration, confirm labels in Gitea UI and re-run a workflow to validate jobs are picked up.
 
 Notes:
 - **Do not commit tokens to the repo.** Use Docker secrets or Portainer's secret store.
 - If you prefer a quick test, the register stack accepts `REGISTRATION_TOKEN` as an env var (less secure). After successful registration, remove the env token and rely on the Docker secret for the daemon stack.
+
+---
+
+## Locking down SSH access via Traefik (recommended)
+The provided `gitea-stack-secured.yml` deploys a TCP middleware `ssh-ipwhitelist` and assigns it to the SSH router for Gitea. It restricts which source IP ranges can reach the SSH service exposed through Traefik (this prevents most unsolicited SSH attempts from the Internet).
+
+If you want to restrict only to your internal network and known IPs, ensure the following CIDRs are present in the stack file's labels (adjust as needed): `10.0.1.0/24`, `192.168.0.0/24`, and your public IP like `83.26.248.249/32`.
+
+You can edit the `ssh-ipwhitelist` ranges directly in `gitea-stack-secured.yml` under the `gitea_server` `deploy.labels` section:
+
+```yaml
+- "traefik.tcp.middlewares.ssh-ipwhitelist.tcp.ipwhitelist.sourcerange=83.26.248.249/32,10.0.1.0/24,172.18.0.0/16,192.168.0.0/24"
+```
+
+After changing the ranges, redeploy the stack (Portainer: Update Stack → Deploy / CLI: `docker stack deploy -c gitea-stack-secured.yml gitea`).
+
+If you prefer to fully disable SSH through Traefik, remove the Traefik TCP labels from the Gitea service and instead use direct host-level rules (firewall) to allow only specific hosts to connect.

.gitea/workflows/ci.yml

@@ -8,6 +8,8 @@ jobs:
   backend:
     name: Backend tests (Maven)
     runs-on: ['self-hosted','swarm-runner']
+    container:
+      image: maven:3.9-jdk-21
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -17,12 +19,6 @@ jobs:
           echo "Runner name: ${{ runner.name }}"
           echo "Runner labels: ${{ toJSON(runner.labels) }}"
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '21'
-
       - name: Cache Maven
         uses: actions/cache@v4
         with:
@@ -38,6 +34,8 @@ jobs:
   frontend:
     name: Frontend build (node)
     runs-on: ['self-hosted','swarm-runner']
+    container:
+      image: node:18-bullseye
     steps:
       - name: Checkout
         uses: actions/checkout@v4

gitea-stack-secured.yml

@@ -0,0 +1,101 @@
+version: "3.8"
+
+services:
+  gitea_server:
+    image: gitea/gitea:1.25.3
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=db:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=gitea
+    networks:
+      - gitea
+      - traefik-public
+    volumes:
+      - nfs-gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    depends_on:
+      - db
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.gitea-web.entrypoints=web-secured"
+        - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+        - "traefik.http.routers.gitea-web.rule=Host(`git.mariuszpacek.pl`)"
+        - "traefik.http.routers.gitea-web.tls.certresolver=http"
+        # SSH (TCP) router - restrict source IPs to trusted ranges only
+        - "traefik.tcp.routers.gitea.entrypoints=gitlab-ssh"
+        - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
+        - "traefik.tcp.routers.gitea.middlewares=ssh-ipwhitelist@docker"
+        - "traefik.tcp.services.gitlab-ssh-port.loadbalancer.server.port=22"
+        # Define the tcp middleware to whitelist trusted source CIDRs (adjust as needed)
+        - "traefik.tcp.middlewares.ssh-ipwhitelist.tcp.ipwhitelist.sourcerange=83.26.248.249/32,10.0.1.0/24,172.18.0.0/16,192.168.0.0/24"
+        # Keep existing HTTP whitelist for web UI
+        - "traefik.http.middlewares.test-ipwhitelist-git.ipwhitelist.sourcerange=83.26.248.249/32,172.18.0.0/16,192.168.0.0/24"
+        - "traefik.http.routers.gitea-web.middlewares=test-ipwhitelist-git"
+
+  db:
+    image: postgres:14
+    environment:
+      - POSTGRES_USER=gitea
+      - POSTGRES_PASSWORD=gitea
+      - POSTGRES_DB=gitea
+    networks:
+      - gitea
+    volumes:
+      - nfs-gitea-db:/var/lib/postgresql/data
+
+  act_runner:
+    image: docker.io/gitea/act_runner:nightly
+    environment:
+      - GITEA_INSTANCE_URL=https://git.mariuszpacek.pl
+      - GITEA_RUNNER_NAME=swarm-runner
+      - GITEA_RUNNER_LABELS=swarm-runner,self-hosted
+      - GITEA_RUNNER_REGISTRATION_TOKEN_FILE=/run/secrets/registration_token
+    secrets:
+      - registration_token
+    volumes:
+      - act_runner-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      mode: global
+      placement:
+        constraints:
+          - node.role == worker
+      restart_policy:
+        condition: any
+
+secrets:
+  registration_token:
+    external: true
+
+volumes:
+  act_runner-data:
+  nfs-gitea:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: nfsvers=4.1,addr=192.168.0.205,rw
+      device: ":/fast-vm/docker/gitea"
+  nfs-gitea-db:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: nfsvers=4.1,addr=192.168.0.205,rw
+      device: ":/fast-vm/docker/gitea-db"
+
+networks:
+  gitea:
+  traefik-public:
+    external: true
+
+# Notes:
+# - Create the Docker secret `registration_token` with the runner token before deploying the stack:
+#   echo "<token>" | docker secret create registration_token -
+# - Allowed SSH source ranges are intentionally restrictive. Add any trusted IP/CIDR as needed (e.g., your home IP).
+# - If you prefer to fully disable SSH access through Traefik, remove the traefik.tcp.* labels on gitea_server.
+# - After deployment, verify Traefik has the tcp middleware `ssh-ipwhitelist` configured (Traefik dashboard).

src/main/java/home/automation/modbus/ModbusRtuTcpRepository.java

@@ -58,7 +58,7 @@ public class ModbusRtuTcpRepository implements Repository {
                     final Double doubleValue = send.getDoubleValue(mapping.getRegistry()) * scale;
                     final String formattedValue = ("FOUR_BYTE_FLOAT".equals(mapping.getDataType()))
                             ? BigDecimal.valueOf(doubleValue).setScale(2, RoundingMode.HALF_UP).stripTrailingZeros().toPlainString()
-                            : Double.toString(doubleValue);
+                            : BigDecimal.valueOf(doubleValue).setScale(1, RoundingMode.HALF_UP).toPlainString();
                     results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), formattedValue));
                     continue;
                 } catch (ClassCastException cce) {
@@ -68,16 +68,16 @@ public class ModbusRtuTcpRepository implements Repository {
                         LOGGER.debug("Batch read returned raw value (type {}): {} for registry {}", raw == null ? "null" : raw.getClass().getSimpleName(), raw, mapping.getRegistry());
                         final double scale = mapping.getScale() == null ? 0.1 : mapping.getScale();
                         if (raw instanceof Number) {
-                            // preserve legacy negative decoding for signed 16-bit values when requested
-                            if (raw instanceof Short) {
-                                final short s = (Short) raw;
-                                if (mapping.getSignedLegacyWrap() != null && mapping.getSignedLegacyWrap() && s < -32000) {
-                                    final double v = -((s + 32768.0) * scale);
-                                    results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), Double.toString(v)));
-                                    continue;
-                                } else {
+                                if (raw instanceof Short) {
+                                    final short s = (Short) raw;
+                                    // Handle legacy negative wrap for very negative 16-bit values
+                                    if (s < -32000) {
+                                        final double v = -((s + 32768.0) * scale);
+                                        results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), BigDecimal.valueOf(v).setScale(1, RoundingMode.HALF_UP).toPlainString()));
+                                        continue;
+                                    } else {
                                     final double v = ((Number) raw).doubleValue() * scale;
-                                    results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), Double.toString(v)));
+                                    results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), BigDecimal.valueOf(v).setScale(1, RoundingMode.HALF_UP).toPlainString()));
                                     continue;
                                 }
                             }
@@ -85,7 +85,7 @@ public class ModbusRtuTcpRepository implements Repository {
                             final double v = ((Number) raw).doubleValue() * scale;
                             final String valStr = ("FOUR_BYTE_FLOAT".equals(mapping.getDataType()))
                                     ? BigDecimal.valueOf(v).setScale(2, RoundingMode.HALF_UP).stripTrailingZeros().toPlainString()
-                                    : Double.toString(v);
+                                    : BigDecimal.valueOf(v).setScale(1, RoundingMode.HALF_UP).toPlainString();
                             results.add(new Registry(mapping.getRegistry(), mapping.getDesc(), valStr));
                             continue;
                         }