From 6e2ec87ccfb9383392e9ab430ada57d669e4a5a2 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 20 Mar 2026 16:40:37 -0400
Subject: [PATCH] debug host key pinning in nginx workflow

---
 .gitea/workflows/deploy-nginx.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy-nginx.yml b/.gitea/workflows/deploy-nginx.yml
index 3c6118c..540f092 100644
--- a/.gitea/workflows/deploy-nginx.yml
+++ b/.gitea/workflows/deploy-nginx.yml
@@ -13,10 +13,12 @@ jobs:
       - name: Deploy via SSH
         run: |
           mkdir -p ~/.ssh
-          echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
+          echo "${{ vars.DEPLOY_HOST_KEY }}" >> ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
+          cat ~/.ssh/known_hosts
+          ssh -v -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
 
   test:
     needs: deploy