From 987324db994e4bf26e0f7ffc88a4932af6a2f564 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 19 Jul 2026 15:16:46 +0000
Subject: [PATCH 1/3] Add GitHub Actions CI/CD pipeline for AlwaysData deploy

- CI: unit tests, production build, API integration, Playwright E2E
- Deploy: rsync backend (with node_modules) and frontend dist over SSH
- Preserve server-side back/.env and back/.htaccess during deploy
- Restart Node.js site via AlwaysData API after backend deploy
- Add front/public/.htaccess for SPA routing (API proxy commented)
- Add CI-friendly MariaDB setup scripts for GitHub Actions service container

Co-authored-by: Benjamin Caure <bcaure@users.noreply.github.com>
---
 .github/workflows/ci.yml     | 94 ++++++++++++++++++++++++++++++++++++
 .github/workflows/deploy.yml | 84 ++++++++++++++++++++++++++++++++
 README.md                    | 32 +++++++++++-
 front/public/.htaccess       | 19 ++++++++
 test/db/reset-test-db.sh     | 46 +++++++++++++-----
 test/db/setup-ci-db.sh       | 23 +++++++++
 6 files changed, 284 insertions(+), 14 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/deploy.yml
 create mode 100644 front/public/.htaccess
 create mode 100755 test/db/setup-ci-db.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..05ce759
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,94 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    services:
+      mariadb:
+        image: mariadb:11
+        env:
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_DATABASE: passwd
+          MARIADB_USER: passwd
+          MARIADB_PASSWORD: passwd
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+
+    env:
+      CI: true
+      MARIADB_HOST: 127.0.0.1
+      MARIADB_ROOT_PASSWORD: root
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            back/package-lock.json
+            front/package-lock.json
+
+      - name: Install MariaDB client
+        run: sudo apt-get update && sudo apt-get install -y mariadb-client
+
+      - name: Install dependencies
+        run: |
+          npm ci
+          npm ci --prefix back
+          npm ci --prefix front
+
+      - name: Set up test database
+        run: bash test/db/setup-ci-db.sh
+
+      - name: Frontend unit tests
+        run: npm run test:front
+
+      - name: Frontend production build
+        run: VITE_API_URL=/api npm run test:build
+
+      - name: API integration tests
+        run: |
+          node --env-file=back/.env.test back/server.js &
+          echo "BACKEND_PID=$!" >> "$GITHUB_ENV"
+          for attempt in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:3001/health >/dev/null; then
+              break
+            fi
+            if [ "$attempt" -eq 30 ]; then
+              echo "Backend did not become ready"
+              exit 1
+            fi
+            sleep 1
+          done
+          npm run verify:api
+
+      - name: Stop backend
+        if: always()
+        run: kill "$BACKEND_PID" 2>/dev/null || true
+
+      - name: Install Playwright browser
+        run: npx playwright install --with-deps chromium
+
+      - name: End-to-end tests
+        run: npm run test:e2e
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..decfb74
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,84 @@
+name: Deploy
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [master]
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+
+    env:
+      SSH_HOST: ssh-cgicertif.alwaysdata.net
+      BACKEND_REMOTE_PATH: /home/cgicertif/passwd/back
+      FRONTEND_REMOTE_PATH: /home/cgicertif/www/passwd
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            back/package-lock.json
+            front/package-lock.json
+
+      - name: Install backend dependencies
+        run: npm ci --omit=dev
+        working-directory: back
+
+      - name: Build frontend
+        run: |
+          npm ci
+          VITE_API_URL=/api npm run build
+        working-directory: front
+
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.ALWAYSDATA_SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts
+
+      - name: Deploy backend
+        run: |
+          rsync -avz --delete \
+            --exclude '.env' \
+            --exclude '.htaccess' \
+            --exclude '.env.test' \
+            --exclude '.env.example' \
+            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes" \
+            back/ \
+            "${{ secrets.ALWAYSDATA_SSH_USER }}@${SSH_HOST}:${BACKEND_REMOTE_PATH}/"
+
+      - name: Deploy frontend
+        run: |
+          rsync -avz --delete \
+            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes" \
+            front/dist/ \
+            "${{ secrets.ALWAYSDATA_SSH_USER }}@${SSH_HOST}:${FRONTEND_REMOTE_PATH}/"
+
+      - name: Restart Node.js site
+        run: |
+          status="$(curl --silent --show-error --write-out '%{http_code}' --output /dev/null \
+            --request POST \
+            --user "${{ secrets.ALWAYSDATA_API_KEY }} account=${{ secrets.ALWAYSDATA_ACCOUNT }}:${{ secrets.ALWAYSDATA_API_PASSWORD }}" \
+            --data '' \
+            "https://api.alwaysdata.com/v1/site/${{ secrets.ALWAYSDATA_BACKEND_SITE_ID }}/restart/")"
+          if [ "$status" != "204" ]; then
+            echo "Site restart failed with HTTP $status"
+            exit 1
+          fi
+          echo "Site restarted successfully."
diff --git a/README.md b/README.md
index 9529be4..bc2db2a 100644
--- a/README.md
+++ b/README.md
@@ -71,13 +71,15 @@ The app runs on port `3000` and proxies `/api` requests to the backend.
 
 ## Deploy instructions
 
-### Backend
+### Manual deploy
+
+#### Backend
 
 - Copy `back/` to your server
 - Configure `.env` for your MariaDB 11.8 instance
 - Run with Node.js 24: `npm start`
 
-### Frontend
+#### Frontend
 
 Build with the production API URL:
 
@@ -88,6 +90,32 @@ VITE_API_URL=/api npm run build
 
 Copy `front/dist/` to your static web root (for example `www/passwd`).
 
+The production `.htaccess` for the static site lives in `front/public/.htaccess` (copied into `dist/` on build). Uncomment the API proxy rule and set your Node.js internal port from AlwaysData → Web → Sites → Environment.
+
+### Automated deploy (GitHub Actions)
+
+Pushing to `master` runs **CI** (unit tests, build, API tests, Playwright E2E), then **Deploy** (rsync over SSH + AlwaysData site restart).
+
+#### GitHub secrets
+
+| Secret | Description |
+|--------|-------------|
+| `ALWAYSDATA_SSH_PRIVATE_KEY` | SSH private key (public key added in AlwaysData → Remote access → SSH keys) |
+| `ALWAYSDATA_SSH_USER` | SSH account name (e.g. `cgicertif`) |
+| `ALWAYSDATA_API_KEY` | API key from AlwaysData profile |
+| `ALWAYSDATA_ACCOUNT` | AlwaysData account name |
+| `ALWAYSDATA_API_PASSWORD` | Account password (used for API basic auth) |
+| `ALWAYSDATA_BACKEND_SITE_ID` | Numeric site ID of the Node.js backend (Web → Sites) |
+
+#### Remote paths
+
+| Component | Path on server |
+|-----------|----------------|
+| Backend | `/home/cgicertif/passwd/back` |
+| Frontend | `/home/cgicertif/www/passwd` |
+
+The deploy workflow preserves the server-side `back/.env` and `back/.htaccess` (excluded from rsync).
+
 ## Automated verification
 
 Run the full end-to-end check (MariaDB setup, frontend tests/build, API integration, frontend preview):
diff --git a/front/public/.htaccess b/front/public/.htaccess
new file mode 100644
index 0000000..38a69a1
--- /dev/null
+++ b/front/public/.htaccess
@@ -0,0 +1,19 @@
+# AlwaysData Apache — static site at www/passwd
+#
+# SPA routing: serve index.html for client-side routes (React Router paths).
+# API proxy: uncomment and set NODE_INTERNAL_PORT to the port shown in
+# AlwaysData → Web → Sites → your Node.js site → Environment.
+
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  RewriteBase /
+
+  # --- API proxy (uncomment and set your Node.js internal port) ---
+  # RewriteRule ^api/(.*)$ http://127.0.0.1:NODE_INTERNAL_PORT/api/$1 [P,L]
+
+  # SPA fallback
+  RewriteRule ^index\.html$ - [L]
+  RewriteCond %{REQUEST_FILENAME} !-f
+  RewriteCond %{REQUEST_FILENAME} !-d
+  RewriteRule . /index.html [L]
+</IfModule>
diff --git a/test/db/reset-test-db.sh b/test/db/reset-test-db.sh
index 838c05d..098dbf4 100755
--- a/test/db/reset-test-db.sh
+++ b/test/db/reset-test-db.sh
@@ -2,14 +2,41 @@
 # Resets the test database to a known, deterministic state.
 # Truncates all tables, reseeds from the init SQL, and sets a known password
 # for the "ben" test user. Safe to run repeatedly (used by the E2E suite).
+#
+# In CI (GitHub Actions), set MARIADB_ROOT_PASSWORD and optionally MARIADB_HOST.
+# Locally, uses sudo + system MariaDB service.
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 TEST_PASSWORD="${TEST_PASSWORD:-testpass123}"
+MARIADB_HOST="${MARIADB_HOST:-127.0.0.1}"
 
-sudo service mariadb start >/dev/null 2>&1 || true
+set_ben_password() {
+  local hash
+  hash="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
+  mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd -e \
+    "UPDATE user SET password='${hash}', used_quota=0 WHERE login='ben';"
+}
 
-sudo mariadb <<'SQL'
+if [ -n "${MARIADB_ROOT_PASSWORD:-}" ]; then
+  mysql_root() {
+    mariadb -h "$MARIADB_HOST" -u root -p"$MARIADB_ROOT_PASSWORD" "$@"
+  }
+
+  mysql_root < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+  mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd <<'SQL'
+SET FOREIGN_KEY_CHECKS = 0;
+TRUNCATE TABLE compte;
+TRUNCATE TABLE site;
+TRUNCATE TABLE user;
+SET FOREIGN_KEY_CHECKS = 1;
+SQL
+  mysql_root passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+  set_ben_password
+else
+  sudo service mariadb start >/dev/null 2>&1 || true
+
+  sudo mariadb <<'SQL'
 CREATE DATABASE IF NOT EXISTS `passwd` DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 CREATE USER IF NOT EXISTS 'passwd'@'localhost' IDENTIFIED BY 'passwd';
 CREATE USER IF NOT EXISTS 'passwd'@'127.0.0.1' IDENTIFIED BY 'passwd';
@@ -18,9 +45,8 @@ GRANT ALL PRIVILEGES ON `passwd`.* TO 'passwd'@'127.0.0.1';
 FLUSH PRIVILEGES;
 SQL
 
-# Ensure schema exists, then wipe all data for a clean slate.
-sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-mariadb -u passwd -ppasswd -h 127.0.0.1 passwd <<'SQL'
+  sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+  mariadb -u passwd -ppasswd -h 127.0.0.1 passwd <<'SQL'
 SET FOREIGN_KEY_CHECKS = 0;
 TRUNCATE TABLE compte;
 TRUNCATE TABLE site;
@@ -28,10 +54,6 @@ TRUNCATE TABLE user;
 SET FOREIGN_KEY_CHECKS = 1;
 SQL
 
-# Reseed fresh data into the now-empty tables.
-sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-
-# Set a known bcrypt password for the "ben" test user and reset its quota.
-HASH="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
-mariadb -u passwd -ppasswd -h 127.0.0.1 passwd -e \
-  "UPDATE user SET password='${HASH}', used_quota=0 WHERE login='ben';"
+  sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+  set_ben_password
+fi
diff --git a/test/db/setup-ci-db.sh b/test/db/setup-ci-db.sh
new file mode 100755
index 0000000..47c5329
--- /dev/null
+++ b/test/db/setup-ci-db.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Provisions the test database in CI (GitHub Actions MariaDB service container).
+# No sudo required — connects as root using MARIADB_ROOT_PASSWORD.
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+MARIADB_HOST="${MARIADB_HOST:-127.0.0.1}"
+MARIADB_ROOT_PASSWORD="${MARIADB_ROOT_PASSWORD:?MARIADB_ROOT_PASSWORD is required}"
+TEST_PASSWORD="${TEST_PASSWORD:-testpass123}"
+
+mysql_cmd() {
+  mariadb -h "$MARIADB_HOST" -u root -p"$MARIADB_ROOT_PASSWORD" "$@"
+}
+
+echo "Provisioning passwd database (CI)..."
+mysql_cmd < "${ROOT_DIR}/db/init-mariadb-11.8.sql"
+
+echo "Setting known test credentials for user ben..."
+HASH="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
+mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd -e \
+  "UPDATE user SET password='${HASH}', used_quota=0 WHERE login='ben';"
+
+echo "Database ready."

From 35d6938881c9d9e9a3137f1307d456c506f81a95 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 19 Jul 2026 15:24:08 +0000
Subject: [PATCH 2/3] Remove CI workflow; deploy directly on push to master

Co-authored-by: Benjamin Caure <bcaure@users.noreply.github.com>
---
 .github/workflows/ci.yml     | 94 ------------------------------------
 .github/workflows/deploy.yml |  7 +--
 README.md                    |  2 +-
 3 files changed, 2 insertions(+), 101 deletions(-)
 delete mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 05ce759..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    services:
-      mariadb:
-        image: mariadb:11
-        env:
-          MARIADB_ROOT_PASSWORD: root
-          MARIADB_DATABASE: passwd
-          MARIADB_USER: passwd
-          MARIADB_PASSWORD: passwd
-        ports:
-          - 3306:3306
-        options: >-
-          --health-cmd="healthcheck.sh --connect --innodb_initialized"
-          --health-interval=10s
-          --health-timeout=5s
-          --health-retries=5
-
-    env:
-      CI: true
-      MARIADB_HOST: 127.0.0.1
-      MARIADB_ROOT_PASSWORD: root
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            back/package-lock.json
-            front/package-lock.json
-
-      - name: Install MariaDB client
-        run: sudo apt-get update && sudo apt-get install -y mariadb-client
-
-      - name: Install dependencies
-        run: |
-          npm ci
-          npm ci --prefix back
-          npm ci --prefix front
-
-      - name: Set up test database
-        run: bash test/db/setup-ci-db.sh
-
-      - name: Frontend unit tests
-        run: npm run test:front
-
-      - name: Frontend production build
-        run: VITE_API_URL=/api npm run test:build
-
-      - name: API integration tests
-        run: |
-          node --env-file=back/.env.test back/server.js &
-          echo "BACKEND_PID=$!" >> "$GITHUB_ENV"
-          for attempt in $(seq 1 30); do
-            if curl -sf http://127.0.0.1:3001/health >/dev/null; then
-              break
-            fi
-            if [ "$attempt" -eq 30 ]; then
-              echo "Backend did not become ready"
-              exit 1
-            fi
-            sleep 1
-          done
-          npm run verify:api
-
-      - name: Stop backend
-        if: always()
-        run: kill "$BACKEND_PID" 2>/dev/null || true
-
-      - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
-
-      - name: End-to-end tests
-        run: npm run test:e2e
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index decfb74..c8dadcb 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,9 +1,7 @@
 name: Deploy
 
 on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
+  push:
     branches: [master]
 
 concurrency:
@@ -12,7 +10,6 @@ concurrency:
 
 jobs:
   deploy:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
 
     env:
@@ -23,8 +20,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
diff --git a/README.md b/README.md
index bc2db2a..a0b2a0e 100644
--- a/README.md
+++ b/README.md
@@ -94,7 +94,7 @@ The production `.htaccess` for the static site lives in `front/public/.htaccess`
 
 ### Automated deploy (GitHub Actions)
 
-Pushing to `master` runs **CI** (unit tests, build, API tests, Playwright E2E), then **Deploy** (rsync over SSH + AlwaysData site restart).
+Pushing to `master` runs the **Deploy** workflow (build, rsync over SSH, AlwaysData site restart).
 
 #### GitHub secrets
 

From 0dbdfe806246444cf5282fbde1434ccac8bf164a Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 19 Jul 2026 15:44:32 +0000
Subject: [PATCH 3/3] Drop misleading rsync excludes and revert CI-only test/db
 changes

- Keep only .env and .htaccess excludes (server-side files that exist)
- Remove setup-ci-db.sh and restore reset-test-db.sh to local-only version

Co-authored-by: Benjamin Caure <bcaure@users.noreply.github.com>
---
 .github/workflows/deploy.yml |  2 --
 test/db/reset-test-db.sh     | 46 ++++++++++--------------------------
 test/db/setup-ci-db.sh       | 23 ------------------
 3 files changed, 12 insertions(+), 59 deletions(-)
 delete mode 100755 test/db/setup-ci-db.sh

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c8dadcb..c0126ab 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -52,8 +52,6 @@ jobs:
           rsync -avz --delete \
             --exclude '.env' \
             --exclude '.htaccess' \
-            --exclude '.env.test' \
-            --exclude '.env.example' \
             -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes" \
             back/ \
             "${{ secrets.ALWAYSDATA_SSH_USER }}@${SSH_HOST}:${BACKEND_REMOTE_PATH}/"
diff --git a/test/db/reset-test-db.sh b/test/db/reset-test-db.sh
index 098dbf4..838c05d 100755
--- a/test/db/reset-test-db.sh
+++ b/test/db/reset-test-db.sh
@@ -2,41 +2,14 @@
 # Resets the test database to a known, deterministic state.
 # Truncates all tables, reseeds from the init SQL, and sets a known password
 # for the "ben" test user. Safe to run repeatedly (used by the E2E suite).
-#
-# In CI (GitHub Actions), set MARIADB_ROOT_PASSWORD and optionally MARIADB_HOST.
-# Locally, uses sudo + system MariaDB service.
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 TEST_PASSWORD="${TEST_PASSWORD:-testpass123}"
-MARIADB_HOST="${MARIADB_HOST:-127.0.0.1}"
 
-set_ben_password() {
-  local hash
-  hash="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
-  mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd -e \
-    "UPDATE user SET password='${hash}', used_quota=0 WHERE login='ben';"
-}
+sudo service mariadb start >/dev/null 2>&1 || true
 
-if [ -n "${MARIADB_ROOT_PASSWORD:-}" ]; then
-  mysql_root() {
-    mariadb -h "$MARIADB_HOST" -u root -p"$MARIADB_ROOT_PASSWORD" "$@"
-  }
-
-  mysql_root < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-  mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd <<'SQL'
-SET FOREIGN_KEY_CHECKS = 0;
-TRUNCATE TABLE compte;
-TRUNCATE TABLE site;
-TRUNCATE TABLE user;
-SET FOREIGN_KEY_CHECKS = 1;
-SQL
-  mysql_root passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-  set_ben_password
-else
-  sudo service mariadb start >/dev/null 2>&1 || true
-
-  sudo mariadb <<'SQL'
+sudo mariadb <<'SQL'
 CREATE DATABASE IF NOT EXISTS `passwd` DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 CREATE USER IF NOT EXISTS 'passwd'@'localhost' IDENTIFIED BY 'passwd';
 CREATE USER IF NOT EXISTS 'passwd'@'127.0.0.1' IDENTIFIED BY 'passwd';
@@ -45,8 +18,9 @@ GRANT ALL PRIVILEGES ON `passwd`.* TO 'passwd'@'127.0.0.1';
 FLUSH PRIVILEGES;
 SQL
 
-  sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-  mariadb -u passwd -ppasswd -h 127.0.0.1 passwd <<'SQL'
+# Ensure schema exists, then wipe all data for a clean slate.
+sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+mariadb -u passwd -ppasswd -h 127.0.0.1 passwd <<'SQL'
 SET FOREIGN_KEY_CHECKS = 0;
 TRUNCATE TABLE compte;
 TRUNCATE TABLE site;
@@ -54,6 +28,10 @@ TRUNCATE TABLE user;
 SET FOREIGN_KEY_CHECKS = 1;
 SQL
 
-  sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
-  set_ben_password
-fi
+# Reseed fresh data into the now-empty tables.
+sudo mariadb passwd < "${ROOT_DIR}/db/init-mariadb-11.8.sql" >/dev/null
+
+# Set a known bcrypt password for the "ben" test user and reset its quota.
+HASH="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
+mariadb -u passwd -ppasswd -h 127.0.0.1 passwd -e \
+  "UPDATE user SET password='${HASH}', used_quota=0 WHERE login='ben';"
diff --git a/test/db/setup-ci-db.sh b/test/db/setup-ci-db.sh
deleted file mode 100755
index 47c5329..0000000
--- a/test/db/setup-ci-db.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Provisions the test database in CI (GitHub Actions MariaDB service container).
-# No sudo required — connects as root using MARIADB_ROOT_PASSWORD.
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-MARIADB_HOST="${MARIADB_HOST:-127.0.0.1}"
-MARIADB_ROOT_PASSWORD="${MARIADB_ROOT_PASSWORD:?MARIADB_ROOT_PASSWORD is required}"
-TEST_PASSWORD="${TEST_PASSWORD:-testpass123}"
-
-mysql_cmd() {
-  mariadb -h "$MARIADB_HOST" -u root -p"$MARIADB_ROOT_PASSWORD" "$@"
-}
-
-echo "Provisioning passwd database (CI)..."
-mysql_cmd < "${ROOT_DIR}/db/init-mariadb-11.8.sql"
-
-echo "Setting known test credentials for user ben..."
-HASH="$(node -e "process.stdout.write(require('${ROOT_DIR}/back/node_modules/bcryptjs').hashSync('${TEST_PASSWORD}', 10))")"
-mariadb -u passwd -ppasswd -h "$MARIADB_HOST" passwd -e \
-  "UPDATE user SET password='${HASH}', used_quota=0 WHERE login='ben';"
-
-echo "Database ready."