B4L/cnx_vinyl
Private
Public Access
8
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deploy workflow: check the SSH key and log its fingerprint
Deploy test site / deploy (push) Successful in 36s
Details

Browse Source 
A first run failed with "Permission denied (publickey)": s1 accepts only
the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user,
and the secret held a different key. The SSH step now strips CR, refuses
a secret that is not an unencrypted private key, and logs the key's
fingerprint for comparison with authorized_keys. The ssh host alias is
renamed so the masked VPS_USER value no longer hides it in the log.
This commit is contained in:
grabowski committed 2026-10-02 21:14:33 +02:00
1 parent 560d073019
commit 52bf35f183
2 files changed
+20 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/workflows/deploy-site.yml
+14 -6
View File
@@ -56,8 +56,16 @@ jobs:
fi
port=${VPS_PORT:-22}
mkdir -p ~/.ssh && chmod 700 ~/.ssh
printf '%s\n' "$VPS_SSH_KEY" > ~/.ssh/deploy_key
printf '%s\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key
# Fail here, not at the server, when the secret is not a usable key,
# and log its fingerprint (public) so it can be compared with
# `ssh-keygen -lf ~deploy/.ssh/authorized_keys` on the server.
if ! ssh-keygen -y -P "" -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub 2>/dev/null; then
echo "::error::VPS_SSH_KEY does not load as an unencrypted private key; paste the whole OpenSSH-format key including the BEGIN/END lines"
exit 1
fi
echo "key in VPS_SSH_KEY: $(ssh-keygen -lf ~/.ssh/deploy_key.pub)"
if [ -n "$VPS_KNOWN_HOSTS" ]; then
printf '%s\n' "$VPS_KNOWN_HOSTS" >> ~/.ssh/known_hosts
else
@@ -73,7 +81,7 @@ jobs:
cat ~/.ssh/keyscan.out >> ~/.ssh/known_hosts
fi
{
echo "Host deploy"
echo "Host webhost"
echo " HostName $VPS_HOST"
echo " User $VPS_USER"
echo " Port $port"
@@ -93,12 +101,12 @@ jobs:
run: |
# SC2029: the paths are meant to expand on the runner side
# shellcheck disable=SC2029
ssh deploy "mkdir -p '$SITE_DIR' '$SITE_DIR-prev' && rm -rf '$SITE_DIR-tmp'"
rsync -az --delete site/dist/ "deploy:$SITE_DIR-prev/"
ssh webhost "mkdir -p '$SITE_DIR' '$SITE_DIR-prev' && rm -rf '$SITE_DIR-tmp'"
rsync -az --delete site/dist/ "webhost:$SITE_DIR-prev/"
# shellcheck disable=SC2029
ssh deploy "mv '$SITE_DIR' '$SITE_DIR-tmp' && mv '$SITE_DIR-prev' '$SITE_DIR' && mv '$SITE_DIR-tmp' '$SITE_DIR-prev'"
ssh webhost "mv '$SITE_DIR' '$SITE_DIR-tmp' && mv '$SITE_DIR-prev' '$SITE_DIR' && mv '$SITE_DIR-tmp' '$SITE_DIR-prev'"
# shellcheck disable=SC2029
live=$(ssh deploy "cat '$SITE_DIR/version.txt'")
live=$(ssh webhost "cat '$SITE_DIR/version.txt'")
echo "live on server: $live"
[ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }