ci: replace appleboy SSH plugin with OpenSSH

Same fix as iled-shop for reliable Pi deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -106,35 +106,40 @@ concurrency:
 
 steps:
   - name: ssh-deploy
-    image: appleboy/drone-ssh
+    image: alpine:3.20
     pull: false
-    settings:
-      host:
-        from_secret: ssh_host
-      username:
-        from_secret: ssh_user
-      key:
-        from_secret: ssh_key
-      port:
-        from_secret: ssh_port
-      script_stop: true
-      envs:
-        - REGISTRY_USERNAME
-        - REGISTRY_PASSWORD
-      script:
-        - |
-          set -euo pipefail
-          echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
-          cd /home/miczek/homelab/tracker
-          docker compose pull
-          docker compose up -d --remove-orphans
-          docker compose ps
-          docker logout registry.zea.lt || true
     environment:
+      SSH_HOST:
+        from_secret: ssh_host
+      SSH_USER:
+        from_secret: ssh_user
+      SSH_KEY:
+        from_secret: ssh_key
+      SSH_PORT:
+        from_secret: ssh_port
       REGISTRY_USERNAME:
         from_secret: registry_username
       REGISTRY_PASSWORD:
         from_secret: registry_password
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
+      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+      - |
+        ssh -i /root/.ssh/id_ed25519 \
+          -p "${SSH_PORT:-22}" \
+          -o StrictHostKeyChecking=accept-new \
+          -o BatchMode=yes \
+          "${SSH_USER}@${SSH_HOST}" \
+          "export REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+        set -euo pipefail
+        echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
+        cd /home/miczek/homelab/tracker
+        docker compose pull
+        docker compose up -d --remove-orphans
+        docker compose ps
+        docker logout registry.zea.lt || true
+        EOS
 
 trigger:
   branch: