From 85361817f92b46cfea5a3dc3974d8f1da6611d10 Mon Sep 17 00:00:00 2001 From: Will Estes Date: Wed, 29 Jul 2026 12:34:12 -0400 Subject: [PATCH] Add CI deploy via scoped rsync instead of a manual Ansible run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously this site had no CI at all — deploys went through a forced-command SSH key that ran a fixed script cloning the repo and building on the production host directly. Now CI builds the site in an isolated container and pushes the output via rsync to a forced-command key restricted (via rrsync) to this site's own docroot only, matching the pattern now used across all the other Hugo sites. Co-Authored-By: Claude Sonnet 5 --- .gitea/workflows/deploy.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .gitea/workflows/deploy.yml diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..606c1b9 --- /dev/null +++ b/.gitea/workflows/deploy.yml @@ -0,0 +1,34 @@ +name: deploy +on: + push: + branches: [main] +jobs: + deploy: + runs-on: ubuntu-latest + container: + image: hugomods/hugo:exts + steps: + - uses: actions/checkout@v4 + with: + submodules: recursive + - name: Install rsync + ssh client + run: | + if command -v apk >/dev/null; then + apk add --no-cache rsync openssh-client + else + apt-get update && apt-get install -y rsync openssh-client + fi + - run: hugo --minify -d public + - name: Deploy via rsync + run: | + mkdir -p ~/.ssh + printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + # The server-side key is forced-command, restricted via rrsync to + # this site's own docroot only (see the static-site-deploy + # Ansible role) — it can push new files but can never read/list + # anything back off the server, and can't reach any other site's + # directory regardless of what path is requested here. + rsync -az --delete -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new" public/ root@sunfloweracres.reground.org: + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}