From c8ffe421251a5d2168078fa5ece312c193ab0b84 Mon Sep 17 00:00:00 2001 From: grabowski Date: Wed, 4 Nov 2026 09:48:22 +0700 Subject: [PATCH] Deploy site: private ~/.ssh files on the runner Run 72 failed with "Bad owner or permissions on /root/.ssh/config" (a loose umask or a reused HOME on the runner). Same fix as thaiai b59230e: umask 077, a fresh config, chmod 600 on config and known_hosts. --- .gitea/workflows/deploy-site.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/deploy-site.yml b/.gitea/workflows/deploy-site.yml index 6cb7ea9..66ac30d 100644 --- a/.gitea/workflows/deploy-site.yml +++ b/.gitea/workflows/deploy-site.yml @@ -53,7 +53,13 @@ jobs: exit 1 fi port=${VPS_PORT:-22} + # ssh refuses a config that is group/world-writable or owned by + # another user ("Bad owner or permissions on ~/.ssh/config"), which + # a runner with a loose umask or a reused HOME produces: create every + # file here private and fresh. + umask 077 mkdir -p ~/.ssh && chmod 700 ~/.ssh + rm -f ~/.ssh/config printf '%s\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key # Fail here, not at the server, when the secret is not a usable key, @@ -87,6 +93,7 @@ jobs: echo " IdentitiesOnly yes" echo " BatchMode yes" } > ~/.ssh/config + chmod 600 ~/.ssh/config ~/.ssh/known_hosts - name: Ensure rsync is available run: command -v rsync || (sudo apt-get update && sudo apt-get install -y rsync) || (apt-get update && apt-get install -y rsync)