kartiandClaude Opus 5
91a086e723
This repo is public, so .gitea/workflows/ci.yml was publishing the web host's tailnet address in a plaintext env: block, together with the deploy account, the checkout path and the unit restarted under sudo -- a complete map of the deploy for any anonymous reader. Host, account, path and service now come from repo secrets (DEPLOY_HOST, DEPLOY_USER, DEPLOY_PATH, DEPLOY_SERVICE), which Gitea masks in run logs. The path and unit name are passed to the remote shell as positional args inside a quoted heredoc so they are never interpolated into the log either. The deploy key secret is renamed CLOUD2_SSH_KEY -> DEPLOY_SSH_KEY to match; it was never actually set, which is why every deploy run so far is red. The rest of docs/DEPLOY.md already used the web-host/build-host pseudonyms; this drops the remaining absolute deploy-account paths from its prose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AaUFYkUTsJn1fnJ89qbvW