From ef24f96b14ec7c2abba973c331163ab7df7eb365 Mon Sep 17 00:00:00 2001 From: Josh Bairstow Date: Tue, 2 Jun 2026 23:16:54 +1000 Subject: [PATCH] docs: define every Actions variable/secret in step 6 REGISTRY_USER/OWNER, REGISTRY_TOKEN, DEPLOY_HOST/USER/SSH_KEY each spelled out with what to store and why, plus deploy-keypair generation. Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 3e09098..be5115c 100644 --- a/README.md +++ b/README.md @@ -163,9 +163,26 @@ host using its Docker, not in a socket-less container). See ### 6. Wire the jb-website repo In the `jb-website` repo settings on Forgejo (`Settings → Actions`): -- **Variables:** `REGISTRY_OWNER` = your lowercase owner. -- **Secrets:** `REGISTRY_USER`, `REGISTRY_TOKEN` (the PAT), `DEPLOY_HOST` - (`45.32.242.27`), `DEPLOY_USER`, `DEPLOY_SSH_KEY`. + +**Variable:** +- `REGISTRY_OWNER` — your **lowercase** Forgejo username/org; the image namespace + (`git.joshbairstow.com//jb-website`). + +**Secrets:** +- `REGISTRY_USER` — your Forgejo login username (the account that owns the PAT); + the username for `docker login`. Usually equals `REGISTRY_OWNER`. +- `REGISTRY_TOKEN` — the PAT with `write:package` scope; the `docker login` password. +- `DEPLOY_HOST` — `45.32.242.27`. +- `DEPLOY_USER` — the VPS account the runner SSHes in as: `root` to start, or a + dedicated `deploy` user (in the `docker` group) for least privilege. +- `DEPLOY_SSH_KEY` — the **private** key of a *dedicated deploy keypair* (full + file incl. `BEGIN/END` lines; paste multi-line — OpenSSH needs the newlines). + NOT your personal key. Generate + install its public half on the VPS: + ```sh + ssh-keygen -t ed25519 -f ~/.ssh/jb-deploy -C forgejo-ci-deploy -N "" + ssh-copy-id -i ~/.ssh/jb-deploy.pub @45.32.242.27 + cat ~/.ssh/jb-deploy # <- paste this into DEPLOY_SSH_KEY + ``` On the **VPS**, prepare the deploy target: ```sh