From 13fdf05121ce4f420a35a15c7ac9c5c6d9e2120c Mon Sep 17 00:00:00 2001
From: haemka <git@haemka.in>
Date: Thu, 13 Aug 2026 15:41:43 +0000
Subject: [PATCH] Add temporary diagnostic step for aquaria connectivity

ssh-keyscan's -v only traces SSH-protocol activity; a pre-handshake
failure (bad DNS, TCP connect hang/drop) prints nothing regardless.
Firewall allow-listing is ruled out (same external IP as a working
manual connection), so check DNS resolution and a raw nc TCP connect
from inside the runner container directly. Remove once root-caused.
---
 .gitea/workflows/build-deploy.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index 4d8a509..cf6f0f5 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -13,13 +13,28 @@ jobs:
       - name: Install system dependencies
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends git rsync openssh-client nodejs
+          apt-get install -y --no-install-recommends git rsync openssh-client nodejs netcat-openbsd dnsutils
 
       - name: Checkout
         uses: actions/checkout@v4
         with:
           submodules: false
 
+      # Temporary diagnostic step — remove once the aquaria connectivity
+      # issue is root-caused. ssh-keyscan swallows pre-handshake failures
+      # even with -v, so this checks DNS + raw TCP connect independently.
+      - name: Diagnose connectivity to deploy host
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts "$DEPLOY_HOST" || echo "getent: no result"
+          dig +short A "$DEPLOY_HOST" || true
+          dig +short AAAA "$DEPLOY_HOST" || true
+          echo "--- TCP connect (IPv4) ---"
+          nc -4 -zv -w 8 "$DEPLOY_HOST" "${DEPLOY_PORT:-22}" || echo "nc exit code: $?"
+
       - name: Set up SSH key
         # Same key used both as the theme repo's deploy key (Gitea) and for
         # the webserver login (below) — one secret, two authorized_keys entries.