From 4a74f74de040c91d42d422154dbae5aa5e9bcdef Mon Sep 17 00:00:00 2001
From: miczek <miczek.r@gmail.com>
Date: Thu, 15 Oct 2026 04:53:19 +0300
Subject: [PATCH] ci: replace appleboy SSH plugin with OpenSSH

Same fix as iled-shop for reliable Pi deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .drone.yml | 51 ++++++++++++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index bfd203b..a40fd2b 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -106,35 +106,40 @@ concurrency:
 
 steps:
   - name: ssh-deploy
-    image: appleboy/drone-ssh
+    image: alpine:3.20
     pull: false
-    settings:
-      host:
-        from_secret: ssh_host
-      username:
-        from_secret: ssh_user
-      key:
-        from_secret: ssh_key
-      port:
-        from_secret: ssh_port
-      script_stop: true
-      envs:
-        - REGISTRY_USERNAME
-        - REGISTRY_PASSWORD
-      script:
-        - |
-          set -euo pipefail
-          echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
-          cd /home/miczek/homelab/tracker
-          docker compose pull
-          docker compose up -d --remove-orphans
-          docker compose ps
-          docker logout registry.zea.lt || true
     environment:
+      SSH_HOST:
+        from_secret: ssh_host
+      SSH_USER:
+        from_secret: ssh_user
+      SSH_KEY:
+        from_secret: ssh_key
+      SSH_PORT:
+        from_secret: ssh_port
       REGISTRY_USERNAME:
         from_secret: registry_username
       REGISTRY_PASSWORD:
         from_secret: registry_password
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
+      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+      - |
+        ssh -i /root/.ssh/id_ed25519 \
+          -p "${SSH_PORT:-22}" \
+          -o StrictHostKeyChecking=accept-new \
+          -o BatchMode=yes \
+          "${SSH_USER}@${SSH_HOST}" \
+          "export REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+        set -euo pipefail
+        echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
+        cd /home/miczek/homelab/tracker
+        docker compose pull
+        docker compose up -d --remove-orphans
+        docker compose ps
+        docker logout registry.zea.lt || true
+        EOS
 
 trigger:
   branch: