Inject runner-absolute SSH opts via deploy-rs --ssh-opts

The gitea-runner is a systemd DynamicUser whose passwd home is /, so ssh
expands ~ to /.ssh/... (not $HOME). deploy-rs passes ssh opts to ssh with
no shell, so a tilde in deploy.nix sshOpts resolved to a missing key and
nix copy failed with 'failed to start SSH connection'.

Keep deploy.nix sshOpts path-free; build absolute -i/known_hosts paths in
deploy.yml from $HOME (bash-expanded) and append them via --ssh-opts, which
deploy-rs merges into NIX_SSHOPTS for the copy and the activation ssh.
Also removes the temporary SSH debug step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -13,39 +13,26 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           # Dedicated key file so we never overwrite the runner user's own key.
-          # nix/deploy.nix pins this via `-i ~/.ssh/gebos_deploy`.
           install -m 600 /dev/stdin ~/.ssh/gebos_deploy <<< "${{ secrets.DEPLOY_SSH_KEY }}"
           ssh-keyscan -H db.gebos.online app.gebos.online ingest.gebos.online >> ~/.ssh/known_hosts 2>/dev/null || true
+          # The gitea-runner is a systemd DynamicUser whose passwd home is `/`,
+          # so ssh expands `~` to `/.ssh/...` rather than $HOME. deploy-rs passes
+          # ssh opts with no shell, so it can't expand $HOME itself. Build the
+          # absolute paths here (bash expands $HOME) and hand them to deploy-rs
+          # via --ssh-opts; they append to nix/deploy.nix's path-free sshOpts.
+          echo "DEPLOY_SSH_OPTS=-i $HOME/.ssh/gebos_deploy -o UserKnownHostsFile=$HOME/.ssh/known_hosts" >> "$GITHUB_ENV"
 
       - name: Build all closures
         run: nix flake check --no-build
 
-      # TEMPORARY: diagnose the SSH auth failure to db-host. Prints only the
-      # PUBLIC key fingerprint (no private material) and the ssh negotiation.
-      # Remove once deploys succeed.
-      - name: Debug SSH to db-host
-        run: |
-          echo "== runner =="; whoami; echo "HOME=$HOME"
-          echo "== installed deploy PUBLIC key (compare to nix/hosts/common.nix:26-27) =="
-          ssh-keygen -y -f ~/.ssh/gebos_deploy -P "" < /dev/null \
-            || echo ">>> KEY UNREADABLE: encrypted (has passphrase) or missing"
-          echo "deploy            should be ...Z+SU"
-          echo "me@larsnolden.com should be ...cdd0"
-          echo "== ssh auth negotiation =="
-          ssh -vvv -F none -i ~/.ssh/gebos_deploy -o IdentitiesOnly=yes \
-              -o StrictHostKeyChecking=accept-new -o BatchMode=yes \
-              deploy@db.gebos.online 'echo CONNECTED as $(whoami)@$(hostname)' 2>&1 \
-            | grep -Ei 'CONNECTED|denied|Server accepts|Offering|Authenticated|not accessible|Host key|incorrect passphrase|No such' \
-            || true
-
       # Order matters: db schema migrations are part of db-host's activation,
       # so it must land first. App-host's Supabase compose stack expects the
       # schemas to exist. mqtt-ingest only needs the network paths to db-host.
       - name: Deploy db-host
-        run: nix run github:serokell/deploy-rs -- .#db-host --skip-checks
+        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#db-host --skip-checks
 
       - name: Deploy app-host
-        run: nix run github:serokell/deploy-rs -- .#app-host --skip-checks
+        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#app-host --skip-checks
 
       - name: Deploy mqtt-ingest
-        run: nix run github:serokell/deploy-rs -- .#mqtt-ingest --skip-checks
+        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#mqtt-ingest --skip-checks

nix/deploy.nix

@@ -12,14 +12,15 @@ let
   };
 in
 {
-  # The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
-  # ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
-  # config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
-  # dedicated deploy key the workflow installs. Applies to both `nix copy` and
-  # the activation SSH.
+  # Path-free ssh options only. The key path and known_hosts are runner-specific
+  # and injected by the deploy.yml via deploy-rs `--ssh-opts` (which appends to
+  # this list for both `nix copy` and the activation SSH). They must be absolute:
+  # the gitea-runner is a systemd DynamicUser whose passwd home is `/`, so ssh
+  # expands `~` to `/.ssh/...` (NOT $HOME) and a tilde here finds no key. The
+  # workflow builds the absolute paths from $HOME, where bash expands correctly.
+  # `-F none` ignores the runner's ~/.ssh/config; IdentitiesOnly pins the key.
   sshOpts = [
     "-F" "none"
-    "-i" "~/.ssh/gebos_deploy"
     "-o" "IdentitiesOnly=yes"
     "-o" "StrictHostKeyChecking=accept-new"
   ];