hmk/haemka.de
1
0
Fork 0
Code Issues Actions Activity

Consolidate GITEA_HOST_KEY/DEPLOY_HOST_KEY into one KNOWN_HOSTS var

Browse Source 
No technical need for separate vars; one holding both known_hosts
lines (pasted straight from an existing trusted known_hosts file) is
simpler to configure.
This commit is contained in:
haemka
2026-08-13 15:48:26 +00:00
parent 247792c116
commit 7468d18885
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build-deploy.yml
+6 -8
View File
@@ -23,20 +23,18 @@ jobs:
- name: Set up SSH key and pinned host keys
# Same key used both as the theme repo's deploy key (Gitea) and for
# the webserver login (below) — one secret, two authorized_keys entries.
# Host keys are pinned via vars (each a full known_hosts-format line,
# e.g. from the server's own /etc/ssh/ssh_host_rsa_key.pub) rather
# than fetched via ssh-keyscan — no extra network calls, no TOFU, and
# no risk of tripping aquaria's connection-rate limiting.
# Host keys are pinned via a var (known_hosts-format lines, pasted
# directly from a known_hosts file that already trusts both hosts)
# rather than fetched via ssh-keyscan — no extra network calls, no
# TOFU, and no risk of tripping aquaria's connection-rate limiting.
env:
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
GITEA_HOST_KEY: ${{ vars.GITEA_HOST_KEY }}
DEPLOY_HOST_KEY: ${{ vars.DEPLOY_HOST_KEY }}
KNOWN_HOSTS: ${{ vars.KNOWN_HOSTS }}
run: |
mkdir -p ~/.ssh
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key
printf '%s\n' "$GITEA_HOST_KEY" >> ~/.ssh/known_hosts
printf '%s\n' "$DEPLOY_HOST_KEY" >> ~/.ssh/known_hosts
printf '%s\n' "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
- name: Fetch theme submodule
run: |