- reorder app.sh to run cert before commit/push (fixes workflow failure on first run)
- quote $SSH_ORIGINAL_COMMAND in authorized_keys to prevent command injection
- add port validation in service.sh nginx command
- pin host key in deploy-beszel.yml workflow
- fix append vs overwrite for known_hosts in deploy-nginx.yml
nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.
- Update all references from timothykim/ to hantim/ org
- Rename DEPLOY_KEY to DEPLOY_SSH_KEY everywhere
- Update README to reference org-level secrets
appleboy/ssh-action's script parameter doesn't set
SSH_ORIGINAL_COMMAND, which deploy.sh needs. Using raw ssh
with the command as an argument works correctly.
timothykim