From 443012e3c71976e8cfe731c3cd4beedd59afcead Mon Sep 17 00:00:00 2001 From: haemka Date: Thu, 13 Aug 2026 15:48:26 +0000 Subject: [PATCH] Consolidate GITEA_HOST_KEY/DEPLOY_HOST_KEY into one KNOWN_HOSTS var No technical need for separate vars; one holding both known_hosts lines (pasted straight from an existing trusted known_hosts file) is simpler to configure. --- .gitea/workflows/build-deploy.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml index e4280a0..14d3cd3 100644 --- a/.gitea/workflows/build-deploy.yml +++ b/.gitea/workflows/build-deploy.yml @@ -23,20 +23,18 @@ jobs: - name: Set up SSH key and pinned host keys # Same key used both as the theme repo's deploy key (Gitea) and for # the webserver login (below) — one secret, two authorized_keys entries. - # Host keys are pinned via vars (each a full known_hosts-format line, - # e.g. from the server's own /etc/ssh/ssh_host_rsa_key.pub) rather - # than fetched via ssh-keyscan — no extra network calls, no TOFU, and - # no risk of tripping aquaria's connection-rate limiting. + # Host keys are pinned via a var (known_hosts-format lines, pasted + # directly from a known_hosts file that already trusts both hosts) + # rather than fetched via ssh-keyscan — no extra network calls, no + # TOFU, and no risk of tripping aquaria's connection-rate limiting. env: DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} - GITEA_HOST_KEY: ${{ vars.GITEA_HOST_KEY }} - DEPLOY_HOST_KEY: ${{ vars.DEPLOY_HOST_KEY }} + KNOWN_HOSTS: ${{ vars.KNOWN_HOSTS }} run: | mkdir -p ~/.ssh printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - printf '%s\n' "$GITEA_HOST_KEY" >> ~/.ssh/known_hosts - printf '%s\n' "$DEPLOY_HOST_KEY" >> ~/.ssh/known_hosts + printf '%s\n' "$KNOWN_HOSTS" >> ~/.ssh/known_hosts - name: Fetch theme submodule run: |