This repo is public, so .gitea/workflows/ci.yml was publishing the web
host's tailnet address in a plaintext env: block, together with the deploy
account, the checkout path and the unit restarted under sudo -- a complete
map of the deploy for any anonymous reader.
Host, account, path and service now come from repo secrets (DEPLOY_HOST,
DEPLOY_USER, DEPLOY_PATH, DEPLOY_SERVICE), which Gitea masks in run logs.
The path and unit name are passed to the remote shell as positional args
inside a quoted heredoc so they are never interpolated into the log either.
The deploy key secret is renamed CLOUD2_SSH_KEY -> DEPLOY_SSH_KEY to match;
it was never actually set, which is why every deploy run so far is red.
The rest of docs/DEPLOY.md already used the web-host/build-host pseudonyms;
this drops the remaining absolute deploy-account paths from its prose.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AaUFYkUTsJn1fnJ89qbvW