halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

docs(deploy): deploy's manual key is pinned to redeploy.sh too

Browse source 
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-29 00:17:11 +01:00
commit 3e24bf8d9d
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
deploy/redeploy.sh
View file

@ -1,8 +1,9 @@
#!/bin/sh
# Deploys learn.halkyon.eu from main. The only command CI's deploy key may run: deploy's
# ~/.ssh/authorized_keys on the server pins that key to this script, from the server itself:
# Deploys learn.halkyon.eu from main. The only command deploy's keys may run: deploy's
# ~/.ssh/authorized_keys on the server pins both to this script, CI's from the server itself:
#
# restrict,from="127.0.0.1,::1",command="/home/deploy/halkyon-learn/deploy/redeploy.sh" ssh-ed25519 … (CI deploy trigger)
# restrict,command="/home/deploy/halkyon-learn/deploy/redeploy.sh" ssh-ed25519 … (manual deploys)
#
# CI passes the commit it has checked. This deploys it only
# - while it is still the tip of main (otherwise the CI run of the newer tip deploys),
@ -12,9 +13,9 @@
# dumps the database first (the last 3 dumps stay in ~/backups), applies the migrations
# before switching to the new server, starts it once more after a migration (see below),
# and fails unless that server answers afterwards. A failure leaves the checkout at the deployed commit, so
# running the CI job again retries. By hand, with your own key:
# running the CI job again retries. By hand, with your own key, which passes the commit as CI does:
#
# ssh sahaquiel-deploy halkyon-learn/deploy/redeploy.sh <commit>
# ssh sahaquiel-deploy <commit>
set -eu
main() {