A first run failed with "Permission denied (publickey)": s1 accepts only
the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user,
and the secret held a different key. The SSH step now strips CR, refuses
a secret that is not an unencrypted private key, and logs the key's
fingerprint for comparison with authorized_keys. The ssh host alias is
renamed so the masked VPS_USER value no longer hides it in the log.
site/ builds the internal test site: public/ served as is (landing page,
robots.txt, static sites) plus demo pages copied out of docs/ (the plant
operation page at /demos/plant-operation/). build.sh fails on dead
internal links and stamps version.txt.
.gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life
web server with the blog's two-directory rename swap, checks version.txt
on the server, purges Cloudflare when a token is set, and checks the
public URL. Secret names match the blog's workflow.
site/Caddyfile is the virtual host to append on s1 (noindex everywhere,
Cloudflare-only like the blog apex, www redirect). site/README.md has the
one-time setup: DNS, Caddy, web root, secrets, runner.
grabowski