test deploy

nix/deploy.nix

@@ -12,7 +12,17 @@ let
   };
 in
 {
-  sshOpts = [ "-o" "StrictHostKeyChecking=accept-new" ];
+  # The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
+  # ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
+  # config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
+  # dedicated deploy key the workflow installs. Applies to both `nix copy` and
+  # the activation SSH.
+  sshOpts = [
+    "-F" "none"
+    "-i" "~/.ssh/gebos_deploy"
+    "-o" "IdentitiesOnly=yes"
+    "-o" "StrictHostKeyChecking=accept-new"
+  ];
   autoRollback = true;
   magicRollback = true;