From efea999a2b682bb63e41a7e1a259d504eeec7443 Mon Sep 17 00:00:00 2001 From: Drew Malzahn Date: Thu, 18 Jun 2026 00:46:53 +0000 Subject: [PATCH] ci: Decode base64-encoded deploy SSH key Storing the raw PEM as a secret mangled it (CRLF/whitespace/newline), causing ssh to fail with "error in libcrypto" at the copy step. Store the key base64-encoded and decode it in the workflow so the PEM round-trips intact. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/deploy.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index 2e48491..02cdc89 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -4,7 +4,10 @@ name: Deploy # Caddy host, and restarts the service. # # Required repo secret: -# DEPLOY_SSH_KEY - private SSH key authorized for ${DEPLOY_USER}@${DEPLOY_HOST} +# DEPLOY_SSH_KEY - base64-encoded private SSH key authorized for +# ${DEPLOY_USER}@${DEPLOY_HOST}. Generate with: +# base64 -w0 < deploy_key # Linux +# base64 -i deploy_key | tr -d '\n' # macOS # # Override host/user/paths via repo variables (Settings > Actions > Variables) # if they ever change; the defaults below match the Justfile. @@ -48,7 +51,10 @@ jobs: run: | command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; } mkdir -p ~/.ssh && chmod 700 ~/.ssh - install -m 600 /dev/stdin ~/.ssh/deploy_key <<< "${{ secrets.DEPLOY_SSH_KEY }}" + # DEPLOY_SSH_KEY is stored base64-encoded so the PEM survives the + # secret round-trip intact (no CRLF/whitespace/newline mangling). + echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null - name: Copy frontend