Deploy workflow: check the SSH key and log its fingerprint

A first run failed with "Permission denied (publickey)": s1 accepts only
the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user,
and the secret held a different key. The SSH step now strips CR, refuses
a secret that is not an unencrypted private key, and logs the key's
fingerprint for comparison with authorized_keys. The ssh host alias is
renamed so the masked VPS_USER value no longer hides it in the log.

.gitea/workflows/deploy-site.yml

@@ -56,8 +56,16 @@ jobs:
           fi
           port=${VPS_PORT:-22}
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$VPS_SSH_KEY" > ~/.ssh/deploy_key
+          printf '%s\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
+          # Fail here, not at the server, when the secret is not a usable key,
+          # and log its fingerprint (public) so it can be compared with
+          # `ssh-keygen -lf ~deploy/.ssh/authorized_keys` on the server.
+          if ! ssh-keygen -y -P "" -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub 2>/dev/null; then
+            echo "::error::VPS_SSH_KEY does not load as an unencrypted private key; paste the whole OpenSSH-format key including the BEGIN/END lines"
+            exit 1
+          fi
+          echo "key in VPS_SSH_KEY: $(ssh-keygen -lf ~/.ssh/deploy_key.pub)"
           if [ -n "$VPS_KNOWN_HOSTS" ]; then
             printf '%s\n' "$VPS_KNOWN_HOSTS" >> ~/.ssh/known_hosts
           else
@@ -73,7 +81,7 @@ jobs:
             cat ~/.ssh/keyscan.out >> ~/.ssh/known_hosts
           fi
           {
-            echo "Host deploy"
+            echo "Host webhost"
             echo "  HostName $VPS_HOST"
             echo "  User $VPS_USER"
             echo "  Port $port"
@@ -93,12 +101,12 @@ jobs:
         run: |
           # SC2029: the paths are meant to expand on the runner side
           # shellcheck disable=SC2029
-          ssh deploy "mkdir -p '$SITE_DIR' '$SITE_DIR-prev' && rm -rf '$SITE_DIR-tmp'"
-          rsync -az --delete site/dist/ "deploy:$SITE_DIR-prev/"
+          ssh webhost "mkdir -p '$SITE_DIR' '$SITE_DIR-prev' && rm -rf '$SITE_DIR-tmp'"
+          rsync -az --delete site/dist/ "webhost:$SITE_DIR-prev/"
           # shellcheck disable=SC2029
-          ssh deploy "mv '$SITE_DIR' '$SITE_DIR-tmp' && mv '$SITE_DIR-prev' '$SITE_DIR' && mv '$SITE_DIR-tmp' '$SITE_DIR-prev'"
+          ssh webhost "mv '$SITE_DIR' '$SITE_DIR-tmp' && mv '$SITE_DIR-prev' '$SITE_DIR' && mv '$SITE_DIR-tmp' '$SITE_DIR-prev'"
           # shellcheck disable=SC2029
-          live=$(ssh deploy "cat '$SITE_DIR/version.txt'")
+          live=$(ssh webhost "cat '$SITE_DIR/version.txt'")
           echo "live on server: $live"
           [ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }
 

site/README.md

@@ -64,7 +64,12 @@ go into `public/` instead.
    Gitea secrets cannot be read back, so they are entered again here from
    the private key file; repo secrets set on `B4L/buildfor_life_web` do not
    reach this repository, B4L organisation secrets only reach it if it moves
-   into B4L. If the private key file is gone, make a new key instead:
+   into B4L. The blog key is `deploy@s1.b4l.co.th`, fingerprint
+   `SHA256:o4w7HL+EsPI3MXbbcYWGn0EykN7qeLtYg0Tc9FI1a3s`, and it is the only
+   key in `/home/deploy/.ssh/authorized_keys` on s1 (sshd on port 2255, so
+   `VPS_PORT` is 2255). The deploy log prints the fingerprint of the key in
+   `VPS_SSH_KEY`; if it differs, the server answers
+   "Permission denied (publickey)". If the private key is gone, make a new key instead:
    `ssh-keygen -t ed25519 -N "" -C cnx_vinyl-deploy -f cnx_vinyl-deploy`,
    public half into the deploy user's `~/.ssh/authorized_keys` on s1,
    private half into `VPS_SSH_KEY`, then delete the local copy.