security: replace key header log with safe public ssh-keygen fingerprint display

.gitea/workflows/ci-prod.yml

@@ -142,25 +142,38 @@ jobs:
             -e KEY_CONTENT="${KEY_CONTENT}" \
             alpine:latest sh -c '
               apk add --no-cache openssh-client rsync && \
+              echo "=== DIAGNOSTIC DETAILS ===" && \
+              echo "Container User: $(whoami) (UID: $(id -u))" && \
+              echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
+              echo "Destination Directory: ${DEST_DIR}" && \
+              echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \
+              echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \
+              echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \
+              echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \
               FOUND_KEY="" && \
               for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \
                 if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \
               done && \
               if [ -n "$FOUND_KEY" ]; then \
-                echo "Using SSH key from file: $FOUND_KEY" && \
+                echo "--> SELECTED KEY FILE: $FOUND_KEY" && \
                 cp "$FOUND_KEY" /tmp/id_rsa ; \
               elif [ -n "$KEY_CONTENT" ]; then \
-                echo "Using SSH key from Gitea secret" && \
+                echo "--> SELECTED KEY FROM: Gitea secret" && \
                 printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
               else \
-                echo "ERROR: No SSH key found!" && exit 1 ; \
+                echo "--> ERROR: No SSH key found!" && exit 1 ; \
               fi && \
               chmod 600 /tmp/id_rsa && \
-              SSH_CMD="ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
-              echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \
+              echo "=== KEY FINGERPRINT ===" && \
+              ls -la /tmp/id_rsa && \
+              ssh-keygen -l -f /tmp/id_rsa && \
+              SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
+              echo "=== EXECUTING REMOTE COMMAND ===" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
-              rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
-              rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
+              echo "=== RSYNC TRANSFER SCRIPT ===" && \
+              rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
+              echo "=== RSYNC TRANSFER ENV ===" && \
+              rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
-              echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
+              echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
             '