hmk/haemka.de
1
0
Fork 0
Code Issues Actions Activity

Move deploy host/port/user/path to repo variables, split port out

Browse Source 
None of these are sensitive, so use Actions variables (vars) instead of
secrets. DEPLOY_PORT is now its own variable (default 22) rather than
being packed into DEPLOY_HOST. Only DEPLOY_SSH_KEY remains a secret.
This commit is contained in:
haemka
2026-08-13 15:19:13 +00:00
parent b68a2cc916
commit 53f6c3da23
1 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build-deploy.yml
+9 -14
View File
@@ -23,19 +23,16 @@ jobs:
- name: Set up SSH key - name: Set up SSH key
# Same key used both as the theme repo's deploy key (Gitea) and for # Same key used both as the theme repo's deploy key (Gitea) and for
# the webserver login (below) — one secret, two authorized_keys entries. # the webserver login (below) — one secret, two authorized_keys entries.
# DEPLOY_HOST may be "fqdn" or "fqdn:port" (non-standard SSH port).
env: env:
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
run: | run: |
mkdir -p ~/.ssh mkdir -p ~/.ssh
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key
DEPLOY_HOSTNAME="${DEPLOY_HOST%%:*}"
DEPLOY_PORT="${DEPLOY_HOST#*:}"
[ "$DEPLOY_PORT" = "$DEPLOY_HOST" ] && DEPLOY_PORT=22
ssh-keyscan -H git.haemka.in >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan -H git.haemka.in >> ~/.ssh/known_hosts 2>/dev/null
ssh-keyscan -H -p "$DEPLOY_PORT" "$DEPLOY_HOSTNAME" >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan -H -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
- name: Fetch theme submodule - name: Fetch theme submodule
run: | run: |
@@ -54,13 +51,11 @@ jobs:
- name: Deploy via rsync - name: Deploy via rsync
env: env:
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
DEPLOY_USER: ${{ secrets.DEPLOY_USER }} DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }} DEPLOY_USER: ${{ vars.DEPLOY_USER }}
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
run: | run: |
DEPLOY_HOSTNAME="${DEPLOY_HOST%%:*}"
DEPLOY_PORT="${DEPLOY_HOST#*:}"
[ "$DEPLOY_PORT" = "$DEPLOY_HOST" ] && DEPLOY_PORT=22
rsync -avz --delete \ rsync -avz --delete \
-e "ssh -i ~/.ssh/deploy_key -p $DEPLOY_PORT -o StrictHostKeyChecking=yes" \ -e "ssh -i ~/.ssh/deploy_key -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=yes" \
output/ "${DEPLOY_USER}@${DEPLOY_HOSTNAME}:${DEPLOY_PATH}" output/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"