From a460e150d69a0edfe0a6c8b556af5ed35fabf792 Mon Sep 17 00:00:00 2001 From: Claude Fable 5 Date: Tue, 14 Jul 2026 14:07:11 +0200 Subject: [PATCH] Deploy Prod with its own SSH key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit prod-deploy.yml reused the test-stage deploy key since go-live (the checklist's optional-hygiene item). A third keypair now completes the one-key-per-stage picture: DEPLOY_SSH_KEY_PROD secret, pubkey dorfteich-deploy-prod in the deploy user's authorized_keys. This separates rotation and audit per stage — not privileges: every key lands in the same docker-group deploy user on the single host. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/prod-deploy.yml | 2 +- deploy/go-live.md | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/prod-deploy.yml b/.gitea/workflows/prod-deploy.yml index 0f645ad..88de163 100644 --- a/.gitea/workflows/prod-deploy.yml +++ b/.gitea/workflows/prod-deploy.yml @@ -38,7 +38,7 @@ jobs: - name: Set up SSH run: | mkdir -p ~/.ssh && chmod 700 ~/.ssh - printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_TEST }}" > ~/.ssh/id_ed25519 + printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_PROD }}" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 printf '%s\n' "${{ secrets.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts diff --git a/deploy/go-live.md b/deploy/go-live.md index c3b628b..cb9ae0e 100644 --- a/deploy/go-live.md +++ b/deploy/go-live.md @@ -70,6 +70,9 @@ the DNS switch. provisioned (`deploy/backup-basel.md`), mirror live on Test AND on Prod since the v0.2.0 deploy (first run verified: all sets on BASEL, `status.json → mirror.lastRun = succeeded`). -- [ ] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret (the - workflows currently reuse the host-wide deploy key stored as - `DEPLOY_SSH_KEY_TEST`). +- [x] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret + (done 2026-07-14: third keypair `dorfteich-deploy-prod` in the + deploy user's authorized_keys, prod-deploy.yml switched off the + test key; every stage now deploys with its own revocable key — + note this separates rotation and audit, not privileges, since all + keys land in the same docker-group deploy user).