Creating Dedicated SSH Keys for GitHub Actions Deployment

Creating Dedicated SSH Keys for GitHub Actions Deployment

This guide will walk you through creating and setting up a dedicated SSH key for your GitHub Actions deployment to your Digital Ocean droplet. Using a dedicated deployment key rather than your personal SSH key is a security best practice.

Why Use a Dedicated Deployment Key?

• Limited scope: Deployment keys can be restricted to specific operations
• Better security: If compromised, only the deployment is affected, not your personal access
• Easier revocation: You can revoke deployment keys without affecting your personal access
• Audit trail: Easier to track which key was used for which operations

Step 1: Generate a New SSH Key Pair

On your local machine, open a terminal and run:

ssh-keygen -t rsa -b 4096 -C "bartendie-github-actions-deploy" -f ~/.ssh/bartendie_do_deploy_key

This command:

• Creates a 4096-bit RSA key
• Adds a comment “bartendie-github-actions-deploy” to identify the key’s purpose
• Saves the key to ~/.ssh/bartendie_do_deploy_key (private key) and ~/.ssh/bartendie_do_deploy_key.pub (public key)

When prompted for a passphrase, you can leave it empty since this key will be used in automated processes.

Step 2: Add the Public Key to Your Digital Ocean Droplet

Transfer the public key to your droplet using the ssh-copy-id command:

ssh-copy-id -i ~/.ssh/bartendie_do_deploy_key.pub root@64.23.245.181

Replace your-droplet-ip with your actual droplet IP address.

Alternatively, you can manually add the key by:

1. Viewing your public key:

   cat ~/.ssh/bartendie_do_deploy_key.pub

2. SSH into your droplet:

   ssh root@64.23.245.181

3. Add the key to authorized_keys:

   echo "YOUR_PUBLIC_KEY" >> ~/.ssh/authorized_keys

Step 3: Add the Private Key to GitHub Secrets

1. View and copy your private key:

   cat ~/.ssh/bartendie_do_deploy_key

2. In your GitHub repository:

   • Go to Settings > Secrets and variables > Actions
   • Click New repository secret
   • Name: SSH_PRIVATE_KEY
   • Value: Paste the entire private key, including the -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- lines

Step 4: Add Known Hosts to GitHub Secrets

GitHub Actions needs to know the SSH fingerprint of your server to establish a secure connection.

1. Get the SSH fingerprint:

   ssh-keyscan your-droplet-ip

2. Add this output as another GitHub secret:

   • Name: SSH_KNOWN_HOSTS
   • Value: Paste the entire output from the ssh-keyscan command

Step A: Add User and Host to GitHub Secrets

1. Create a secret for the SSH user:

   • Name: SSH_USER
   • Value: root (or your preferred user)

2. Create a secret for the host:

   • Name: SSH_HOST
   • Value: Your droplet’s IP address

Step 6: Test the Deployment

1. Push a commit to your repository
2. Check the GitHub Actions workflow runs successfully
3. Verify your Docusaurus site is deployed to your Digital Ocean droplet

Security Considerations

• Store your private key securely; don’t commit it to any repository
• If you suspect the key is compromised, immediately remove it from your droplet and generate a new one
• Consider setting up user-level access instead of root for improved security
• Regularly rotate your deployment keys as part of your security practice

Troubleshooting

If you encounter permission issues:

1. Check the permissions on your droplet:

   ls -la /var/www/html

2. Ensure the deploy user has write permissions:

   chown -R root:www-data /var/www/html
   chmod -R 775 /var/www/html