chore: retire deploy.yml in favor of Tailscale-only manual deploys#40
Merged
Conversation
The VPS is reachable only over Tailscale; SSH is closed to the public internet. Re-enabling auto-deploy via appleboy/ssh-action would require widening the firewall to GitHub's runner IP ranges -- a strictly worse security posture for a payment facilitator with a live mainnet seed phrase on disk. Changes: - Delete .github/workflows/deploy.yml (was broken on every merge anyway: parse-time failures before #25, missing DEPLOY_* secrets after #25) - Document the canonical phased manual deploy in docs/operations.md (matches the pattern we used for the 2026-05-15 quick-wins deploy) - Add a "production deploys are manual by design" section to docs/deployment.md explaining why and pointing to the runbook - CI (.github/workflows/ci.yml) stays untouched -- it runs only inside the runner with no outbound SSH If auto-deploy is ever wanted again, the right shape is the Tailscale GitHub Action, which adds the runner to the tailnet for the deploy duration without opening any public port. Deferred until there's need. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The VPS is reachable only over Tailscale; public SSH is closed. Re-enabling auto-deploy via `appleboy/ssh-action` would require widening the firewall to GitHub's runner IP ranges — a strictly worse security posture for a payment facilitator with a live mainnet seed phrase on disk. Per the user's call.
`deploy.yml` has been broken on every merge since the rename anyway (parse-time failures pre-#25, missing `DEPLOY_*` secrets post-#25). Better to remove it than leave a confusing always-red workflow in the actions tab.
Changes
What stays the same
Test plan
🤖 Generated with Claude Code