fix: deploy via SSH, build + deploy on VPS directly

The CI runner container can't access the VPS host's systemd and Nix
directly. Instead of installing Nix in the container and trying to
access the host, SSH directly to the VPS to build and deploy.

This approach:
1. SSHs to the VPS using the VPS_SSH_KEY_VALUE secret
2. Pulls the latest code on the VPS
3. Builds with Nix directly on the VPS
4. Updates nix-env profile and restarts systemd service

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -13,33 +13,43 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Install Nix
+      - name: Deploy via SSH (build + deploy on VPS)
-        run: |
+        env:
-          curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix \
+          VPS_HOST: ${{ secrets.VPS_HOST }}
-            | sh -s -- install --no-confirm 2>&1
+          VPS_USER: ${{ secrets.VPS_USER }}
-          echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"
+          VPS_SSH_KEY_VALUE: ${{ secrets.VPS_SSH_KEY_VALUE }}
-
-      - name: Build with Nix
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh || true
-          nix build .#teleuploader --impure --option sandbox false 2>&1
-
-      - name: Deploy via Docker socket (host access)
         run: |
           set -eu
-          STORE_PATH=$(readlink result)
+          key_file=$(mktemp)
+          printf '%s\n' "$VPS_SSH_KEY_VALUE" > "$key_file"
+          chmod 600 "$key_file"
 
-          # Use Docker socket to run commands on the VPS host
+          ssh -i "$key_file" -o StrictHostKeyChecking=no \
-          docker run --rm --pid=host --privileged \
+            "${VPS_USER}@${VPS_HOST}" \
-            -v /:/host \
-            alpine:latest \
-            chroot /host sh -c "
-              nix-env --profile /nix/var/nix/profiles/teleuploader --set '$STORE_PATH' && \
-              systemctl restart teleuploader
             "
 
-          echo "=== Service status ==="
+            # Source Nix profile (Determinate Nix installs to ~/.nix-profile)
-          docker run --rm --pid=host --privileged \
+            export PATH=\"\$HOME/.nix-profile/bin:\$PATH\"
-            -v /:/host \
+
-            alpine:latest \
+            # Clone or pull latest code
-            chroot /host sh -c "systemctl status teleuploader --no-pager | head -15"
+            REPO_DIR=\"/home/teleuploader/repo\"
+            if [ -d \"\$REPO_DIR/.git\" ]; then
+              cd \"\$REPO_DIR\" && git pull origin main 2>&1
+            else
+              mkdir -p \"\$REPO_DIR\"
+              git clone https://git.imrnes.team/MythEclipse/TeleUploader \"\$REPO_DIR\" 2>&1
+              cd \"\$REPO_DIR\"
+            fi
+
+            cd \"\$REPO_DIR\"
+
+            # Build with Nix
+            nix build .#teleuploader --impure --option sandbox false 2>&1
+
+            # Deploy
+            STORE_PATH=\$(readlink result)
+            nix-env --profile /nix/var/nix/profiles/teleuploader --set \"\$STORE_PATH\"
+            systemctl restart teleuploader
+            sleep 3
+            systemctl status teleuploader --no-pager | head -15
+            "