luxick/mcg-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't force StrictHostKeyChecking in the local deploy script

Browse Source 
The script runs interactively against a host the operator has already
connected to, so pinning the option added nothing. Removing the override
lets ssh use its default (ask): it consults the user's own known_hosts
and prompts once on first connect, and still refuses a changed host key
afterwards.

Left as-is in CI, which has no prompt and pins the key via the
SSH_KNOWN_HOSTS secret.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
luxick
2026-07-30 16:13:58 +02:00
parent 5ee02c34f0
commit 2fcb2fd219
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy.sh
+4 -1
View File
@@ -99,7 +99,10 @@ fi
# -------------------------------------------------------------- deploy --- # -------------------------------------------------------------- deploy ---
SSH_CMD="ssh -i $SSH_KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" # No StrictHostKeyChecking override: ssh falls back to its default (ask), so it
# uses your personal ~/.ssh/known_hosts and prompts once on first connect. CI
# pins it to yes instead, because it has no prompt and a known_hosts secret.
SSH_CMD="ssh -i $SSH_KEY -o IdentitiesOnly=yes"
TARGET="${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/" TARGET="${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/"
RSYNC_OPTS=(-az --delete --checksum) RSYNC_OPTS=(-az --delete --checksum)