drew/fabula-ultima-html
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: Decode base64-encoded deploy SSH key #4

Merged
drew merged 1 commits from shorten-share-url into master 2026-06-17 20:49:05 -04:00
Conversation 0 Commits 1 Files Changed 1 +8 -2
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/deploy.yaml
View File

@@ -4,7 +4,10 @@ name: Deploy
# Caddy host, and restarts the service. # Caddy host, and restarts the service.
# #
# Required repo secret: # Required repo secret:
# DEPLOY_SSH_KEY - private SSH key authorized for ${DEPLOY_USER}@${DEPLOY_HOST} # DEPLOY_SSH_KEY - base64-encoded private SSH key authorized for
# ${DEPLOY_USER}@${DEPLOY_HOST}. Generate with:
# base64 -w0 < deploy_key # Linux
# base64 -i deploy_key | tr -d '\n' # macOS
# #
# Override host/user/paths via repo variables (Settings > Actions > Variables) # Override host/user/paths via repo variables (Settings > Actions > Variables)
# if they ever change; the defaults below match the Justfile. # if they ever change; the defaults below match the Justfile.
@@ -48,7 +51,10 @@ jobs:
run: | run: |
command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; } command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; }
mkdir -p ~/.ssh && chmod 700 ~/.ssh mkdir -p ~/.ssh && chmod 700 ~/.ssh
install -m 600 /dev/stdin ~/.ssh/deploy_key <<< "${{ secrets.DEPLOY_SSH_KEY }}" # DEPLOY_SSH_KEY is stored base64-encoded so the PEM survives the
# secret round-trip intact (no CRLF/whitespace/newline mangling).
echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key
ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
- name: Copy frontend - name: Copy frontend