MythEclipse/imphnen-frontend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: use single INFRA_DEPLOY_KEY for both GitHub and server SSH

Browse Source 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
maulanasdqn
2026-03-31 16:06:50 +07:00
co-authored by Claude Opus 4.6
parent aef8d59c9f
commit 419335d6b3
2 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/nix-build.yml
+5 -10
View File
@@ -75,21 +75,16 @@ jobs:
- name: Setup SSH - name: Setup SSH
env: env:
INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }} INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
run: | run: |
mkdir -p ~/.ssh mkdir -p ~/.ssh
echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/infra_deploy echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/deploy_key
chmod 600 ~/.ssh/infra_deploy chmod 600 ~/.ssh/deploy_key
if [ -n "${SERVER_SSH_KEY}" ]; then
echo "${SERVER_SSH_KEY}" > ~/.ssh/server_key
chmod 600 ~/.ssh/server_key
fi
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null
- name: Update infra flake.lock - name: Update infra flake.lock
run: | run: |
export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes" export GIT_SSH_COMMAND="ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes"
git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra
cd /tmp/infra cd /tmp/infra
nix flake update imphnen-frontend nix flake update imphnen-frontend
@@ -105,9 +100,9 @@ jobs:
- name: Deploy to server - name: Deploy to server
run: | run: |
ssh -i ~/.ssh/server_key -o StrictHostKeyChecking=accept-new root@167.235.70.37 \ ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new root@167.235.70.37 \
'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30' 'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30'
- name: Cleanup - name: Cleanup
if: always() if: always()
run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key run: rm -f ~/.ssh/deploy_key
CLAUDE.md
+2 -2
View File
@@ -73,9 +73,9 @@ All Nix config is in a single `flake.nix`:
2. **build**: Matrix strategy builds only affected apps with Nix, pushes to Cachix 2. **build**: Matrix strategy builds only affected apps with Nix, pushes to Cachix
3. **deploy**: Clones `imphnen-infrastructure`, updates `flake.lock`, pushes, then runs `clan machines update hetzner` to deploy to the Hetzner server 3. **deploy**: Clones `imphnen-infrastructure`, updates `flake.lock`, pushes, then runs `clan machines update hetzner` to deploy to the Hetzner server
Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY`, `SERVER_SSH_KEY` Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY` (SSH key for both GitHub and server access)
Deployment uses [clan](https://clan.lol) via `imphnen-infrastructure` repo. The server (167.235.70.37) pulls pre-built packages from Cachix. The server (167.235.70.37) pulls pre-built packages from Cachix during `nixos-rebuild`.
## Environment Variables ## Environment Variables