From 2f4c7eaeb64264787f644416f7ff1faf2b07e09f Mon Sep 17 00:00:00 2001 From: Will Estes Date: Wed, 29 Jul 2026 12:19:24 -0400 Subject: [PATCH] Switch deploy to CI-build + scoped rsync instead of shared-runner bind-mount Piloting a fleet-wide change: CI now builds the site in an isolated container and pushes output via rsync to a forced-command SSH key restricted (via rrsync) to this site's own docroot only, instead of relying on the shared Actions runner's blanket /var/www/** bind-mount capability. See the static-site-deploy Ansible role. Co-Authored-By: Claude Sonnet 5 --- .gitea/workflows/deploy.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index e4dd210..f6200d6 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -7,10 +7,28 @@ jobs: runs-on: ubuntu-latest container: image: hugomods/hugo:exts - volumes: - - /var/www/reground.org:/var/www/reground.org steps: - uses: actions/checkout@v4 with: submodules: recursive - - run: hugo --minify -d /var/www/reground.org + - name: Install rsync + ssh client + run: | + if command -v apk >/dev/null; then + apk add --no-cache rsync openssh-client + else + apt-get update && apt-get install -y rsync openssh-client + fi + - run: hugo --minify -d public + - name: Deploy via rsync + run: | + mkdir -p ~/.ssh + printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + # The server-side key is forced-command, restricted via rrsync to + # this site's own docroot only (see the static-site-deploy + # Ansible role) — it can push new files but can never read/list + # anything back off the server, and can't reach any other site's + # directory regardless of what path is requested here. + rsync -az --delete -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new" public/ root@reground.org: + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}