- Fix nix copy URL: ***@ → $VPS_USER@ - Store path from build output, passed across jobs - Deploy job waits for all builds via needs: build - SSH key setup in its own step, guarded by main branch - Only deploy on main branch pushes - Remote deploy script fetches from VPS nix store