From 419335d6b3d223dec0daebd012b2452e261c333b Mon Sep 17 00:00:00 2001 From: maulanasdqn Date: Tue, 31 Mar 2026 16:06:50 +0700 Subject: [PATCH] ci: use single INFRA_DEPLOY_KEY for both GitHub and server SSH Co-Authored-By: Claude Opus 4.6 --- .github/workflows/nix-build.yml | 15 +++++---------- CLAUDE.md | 4 ++-- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index c1770ce..ecbc1dc 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -75,21 +75,16 @@ jobs: - name: Setup SSH env: INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }} - SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }} run: | mkdir -p ~/.ssh - echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/infra_deploy - chmod 600 ~/.ssh/infra_deploy - if [ -n "${SERVER_SSH_KEY}" ]; then - echo "${SERVER_SSH_KEY}" > ~/.ssh/server_key - chmod 600 ~/.ssh/server_key - fi + echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null - name: Update infra flake.lock run: | - export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes" + export GIT_SSH_COMMAND="ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes" git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra cd /tmp/infra nix flake update imphnen-frontend @@ -105,9 +100,9 @@ jobs: - name: Deploy to server run: | - ssh -i ~/.ssh/server_key -o StrictHostKeyChecking=accept-new root@167.235.70.37 \ + ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new root@167.235.70.37 \ 'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30' - name: Cleanup if: always() - run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key + run: rm -f ~/.ssh/deploy_key diff --git a/CLAUDE.md b/CLAUDE.md index e7ecd2d..1235804 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -73,9 +73,9 @@ All Nix config is in a single `flake.nix`: 2. **build**: Matrix strategy builds only affected apps with Nix, pushes to Cachix 3. **deploy**: Clones `imphnen-infrastructure`, updates `flake.lock`, pushes, then runs `clan machines update hetzner` to deploy to the Hetzner server -Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY`, `SERVER_SSH_KEY` +Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY` (SSH key for both GitHub and server access) -Deployment uses [clan](https://clan.lol) via `imphnen-infrastructure` repo. The server (167.235.70.37) pulls pre-built packages from Cachix. +The server (167.235.70.37) pulls pre-built packages from Cachix during `nixos-rebuild`. ## Environment Variables