feat: docker ignore

.dockerignore

@@ -1,7 +1,9 @@
 .git
+.kamal/secrets*
 vendor
 node_modules
 storage/logs
 storage/framework/cache/data
 .env
+.env.*
 public/storage

.gitea/workflows/deploy.yml

@@ -37,59 +37,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Prepare SSH agent
-        env:
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-        run: |
-          set -eu
-
-          eval "$(ssh-agent -s)"
-          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
-
-          printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
-
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          ssh-keyscan -H "${SSH_HOST:-89.167.35.217}" >> ~/.ssh/known_hosts
-
-      - name: Prepare Kamal network
-        env:
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-        run: |
-          set -eu
-
-          REMOTE_HOST="${SSH_HOST:-89.167.35.217}"
-          REMOTE_USER="${SSH_USER:-root}"
-
-          ssh "$REMOTE_USER@$REMOTE_HOST" <<'EOF'
-          set -eu
-
-          docker network inspect kamal >/dev/null 2>&1 || docker network create kamal
-
-          for container in bemeal-pgsql bemeal-redis bemeal-meilisearch bemeal-adminer; do
-            if docker inspect "$container" >/dev/null 2>&1; then
-              docker network connect kamal "$container" >/dev/null 2>&1 || true
-            fi
-          done
-          EOF
-
-      - name: Write Kamal secrets
-        run: |
-          set -eu
-
-          mkdir -p .kamal
-          cat > .kamal/secrets <<'EOF'
-          GITEA_TOKEN=$GITEA_TOKEN
-          APP_KEY=$APP_KEY
-          DB_DATABASE=$DB_DATABASE
-          DB_USERNAME=$DB_USERNAME
-          DB_PASSWORD=$DB_PASSWORD
-          MEILISEARCH_KEY=$MEILISEARCH_KEY
-          EOF
-          chmod 600 .kamal/secrets
-
       - name: Deploy
         env:
           GITEA_TOKEN: ${{ secrets.TOKEN_GITEA }}
@@ -100,19 +47,20 @@ jobs:
           MEILISEARCH_KEY: ${{ secrets.MEILISEARCH_KEY }}
           SSH_HOST: ${{ secrets.SSH_HOST }}
           SSH_USER: ${{ secrets.SSH_USER }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
           set -eu
 
           WORKSPACE="${GITHUB_WORKSPACE:-$PWD}"
           test -f "$WORKSPACE/config/deploy.yml"
 
-          docker run --rm \
-            -v "$WORKSPACE:/workdir" \
-            -v "$SSH_AUTH_SOCK:/ssh-agent" \
-            -v "$HOME/.ssh:/root/.ssh:ro" \
+          tar \
+            --exclude=.kamal/secrets \
+            --exclude=.kamal/secrets.* \
+            --exclude=.env \
+            --exclude=.env.* \
+            -C "$WORKSPACE" -cf - . | docker run --rm -i \
             -v /var/run/docker.sock:/var/run/docker.sock \
-            -w /workdir \
-            -e SSH_AUTH_SOCK=/ssh-agent \
             -e GITEA_TOKEN \
             -e APP_KEY \
             -e DB_DATABASE \
@@ -121,4 +69,45 @@ jobs:
             -e MEILISEARCH_KEY \
             -e SSH_HOST \
             -e SSH_USER \
-            "$KAMAL_IMAGE" deploy
+            -e SSH_PRIVATE_KEY \
+            --entrypoint /bin/sh \
+            "$KAMAL_IMAGE" -lc '
+              set -eu
+
+              mkdir -p /workdir /root/.ssh
+              tar -xf - -C /workdir
+              cd /workdir
+
+              chmod 700 /root/.ssh
+              printf "%s\n" "$SSH_PRIVATE_KEY" | tr -d "\r" > /root/.ssh/id_ed25519
+              chmod 600 /root/.ssh/id_ed25519
+              ssh-keyscan -H "${SSH_HOST:-89.167.35.217}" >> /root/.ssh/known_hosts
+
+              mkdir -p .kamal
+              cat > .kamal/secrets <<'"'"'SECRETS'"'"'
+          GITEA_TOKEN=$GITEA_TOKEN
+          APP_KEY=$APP_KEY
+          DB_DATABASE=$DB_DATABASE
+          DB_USERNAME=$DB_USERNAME
+          DB_PASSWORD=$DB_PASSWORD
+          MEILISEARCH_KEY=$MEILISEARCH_KEY
+          SECRETS
+              chmod 600 .kamal/secrets
+
+              REMOTE_HOST="${SSH_HOST:-89.167.35.217}"
+              REMOTE_USER="${SSH_USER:-root}"
+
+              ssh "$REMOTE_USER@$REMOTE_HOST" <<'"'"'REMOTE'"'"'
+          set -eu
+
+          docker network inspect kamal >/dev/null 2>&1 || docker network create kamal
+
+          for container in bemeal-pgsql bemeal-redis bemeal-meilisearch bemeal-adminer; do
+            if docker inspect "$container" >/dev/null 2>&1; then
+              docker network connect kamal "$container" >/dev/null 2>&1 || true
+            fi
+          done
+          REMOTE
+
+              /kamal/bin/kamal deploy
+            '