fix CI deploy: use global SSH config for deploy-rs

The nix-daemon runs as root and cannot access the gitea-runner user's
~/.ssh directory. Solution: write the deploy key and SSH config to
/etc/deploy/ and /etc/ssh/ssh_config.d/ which are readable by all
users including the nix-daemon.

- Deploy key is written to /etc/deploy/key (cleaned up after deploy)
- SSH config in /etc/ssh/ssh_config.d/deploy.conf (cleaned up after)
- Minimal NOPASSWD sudo rules for gitea-runner to manage these files
- Reverts local deploy approach, back to deploy-rs over SSH

.forgejo/workflows/deploy.yml

@@ -22,11 +22,31 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Build system configuration
-        run: nix build .#nixosConfigurations.cryodev-main.config.system.build.toplevel --out-link result
+      - name: Set up SSH
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          # Write key to a shared location readable by nix-daemon
+          sudo mkdir -p /etc/deploy
+          echo "$DEPLOY_KEY" | sudo tee /etc/deploy/key > /dev/null
+          sudo chmod 600 /etc/deploy/key
 
-      - name: Deploy locally
-        run: sudo nix-env -p /nix/var/nix/profiles/system --set $(readlink -f result) && sudo result/bin/switch-to-configuration switch
+          # Global SSH config so both the runner and nix-daemon can use it
+          sudo tee /etc/ssh/ssh_config.d/deploy.conf > /dev/null << 'EOF'
+          Host cryodev.xyz
+            Port 2299
+            User root
+            IdentityFile /etc/deploy/key
+            StrictHostKeyChecking accept-new
+          EOF
+
+      - name: Deploy with deploy-rs
+        run: nix run github:serokell/deploy-rs -- -s .#cryodev-main
+
+      - name: Clean up SSH
+        if: always()
+        run: |
+          sudo rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
 
   build-pi-images:
     needs: flake-check

modules/nixos/forgejo-runner/default.nix

@@ -31,10 +31,13 @@ in
   config = mkIf cfg.enable {
     nix.settings.trusted-users = [ "gitea-runner" ];
 
-    # Allow gitea-runner to deploy system configurations without password
+    # Allow gitea-runner to manage deploy keys and SSH config for CI/CD
     security.sudo.extraConfig = ''
-      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/nix-env -p /nix/var/nix/profiles/system --set *
-      gitea-runner ALL=(root) NOPASSWD: /nix/store/*/bin/switch-to-configuration *
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/deploy/key
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/ssh/ssh_config.d/deploy.conf
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/mkdir -p /etc/deploy
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/chmod 600 /etc/deploy/key
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
     '';
 
     services.gitea-actions-runner = {