ci: deploy through restricted ci-deploy key #32

Merged

bittabola merged 1 commit from ci-restricted-deploy into main 2026-10-04 15:41:27 -06:00

Conversation 0 Commits 1 Files changed 1 +10 -11

bittabola commented 2026-10-04 15:36:29 -06:00

Owner

Copy link

The VPS key used by CI (VPS_SSH_KEY) is now restricted with restrict,command="/usr/local/sbin/ci-deploy". Any other command is refused, so old-style deploys fail until this is merged.

• Deploy: ssh … "deploy <stack>" (pulls only git.fayzullaev.ca/ images, then docker compose up -d)
• Verify: http <port> <path> or status <stack> in a runner-side retry loop
• Compose files are not uploaded by CI anymore; sync changes to ~/docker/<stack>/ by hand

Vault: Project - Restrict VPS CI Deploy Key.

🤖 Generated with Claude Code

The VPS key used by CI (`VPS_SSH_KEY`) is now restricted with `restrict,command="/usr/local/sbin/ci-deploy"`. Any other command is refused, so old-style deploys fail until this is merged. - Deploy: `ssh … "deploy <stack>"` (pulls only `git.fayzullaev.ca/` images, then `docker compose up -d`) - Verify: `http <port> <path>` or `status <stack>` in a runner-side retry loop - Compose files are **not** uploaded by CI anymore; sync changes to `~/docker/<stack>/` by hand Vault: Project - Restrict VPS CI Deploy Key. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

bittabola added 1 commit 2026-10-04 15:36:29 -06:00

ci: deploy through restricted ci-deploy key ... b877321363

The VPS deploy key now runs only /usr/local/sbin/ci-deploy (deploy|status|logs <stack>, http <port> <path>). Deploy and verify send those verbs; compose files are no longer uploaded by CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bittabola merged commit 86065d2511 into main 2026-10-04 15:41:27 -06:00

bittabola deleted branch ci-restricted-deploy 2026-10-04 15:41:27 -06:00

bittabola referenced this pull request from a commit 2026-10-04 15:41:28 -06:00

Merge pull request 'ci: deploy through restricted ci-deploy key' (#32) from ci-restricted-deploy into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

bittabola/tarjimon!32

No description provided.