From 53f6c3da233cc63eeb11f6fefe59b2be25636898 Mon Sep 17 00:00:00 2001
From: "Henner M. Kruse" <git@haemka.in>
Date: Thu, 13 Aug 2026 15:19:13 +0000
Subject: [PATCH] Move deploy host/port/user/path to repo variables, split port
 out

None of these are sensitive, so use Actions variables (vars) instead of
secrets. DEPLOY_PORT is now its own variable (default 22) rather than
being packed into DEPLOY_HOST. Only DEPLOY_SSH_KEY remains a secret.
---
 .gitea/workflows/build-deploy.yml | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index a125a53..089c498 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -23,19 +23,16 @@ jobs:
       - name: Set up SSH key
         # Same key used both as the theme repo's deploy key (Gitea) and for
         # the webserver login (below) — one secret, two authorized_keys entries.
-        # DEPLOY_HOST may be "fqdn" or "fqdn:port" (non-standard SSH port).
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
         run: |
           mkdir -p ~/.ssh
           printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          DEPLOY_HOSTNAME="${DEPLOY_HOST%%:*}"
-          DEPLOY_PORT="${DEPLOY_HOST#*:}"
-          [ "$DEPLOY_PORT" = "$DEPLOY_HOST" ] && DEPLOY_PORT=22
           ssh-keyscan -H git.haemka.in >> ~/.ssh/known_hosts 2>/dev/null
-          ssh-keyscan -H -p "$DEPLOY_PORT" "$DEPLOY_HOSTNAME" >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan -H -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Fetch theme submodule
         run: |
@@ -54,13 +51,11 @@ jobs:
 
       - name: Deploy via rsync
         env:
-          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
         run: |
-          DEPLOY_HOSTNAME="${DEPLOY_HOST%%:*}"
-          DEPLOY_PORT="${DEPLOY_HOST#*:}"
-          [ "$DEPLOY_PORT" = "$DEPLOY_HOST" ] && DEPLOY_PORT=22
           rsync -avz --delete \
-            -e "ssh -i ~/.ssh/deploy_key -p $DEPLOY_PORT -o StrictHostKeyChecking=yes" \
-            output/ "${DEPLOY_USER}@${DEPLOY_HOSTNAME}:${DEPLOY_PATH}"
+            -e "ssh -i ~/.ssh/deploy_key -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=yes" \
+            output/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"