fix(ci): combine --net=host with Base64 payload transfer for key, script, and env to resolve VPN routing and file isolation

.gitea/workflows/ci-prod.yml

@@ -120,29 +120,75 @@ jobs:
           DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }}
           DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }}
           REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
+          PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }}
+          SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }}
+          SSH_KEY_SECRET: ${{ secrets.SSH_KEY }}
         run: |
           TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}"
           TARGET_USER="${DB_SERVER_USER:-root}"
           PORT="${REMOTE_PORT:-22}"
           DEST_DIR="/opt/as-talange"
+          RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
+
+          if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then
+            RAW_KEY=$(cat "${RAW_KEY}")
+          fi
+
+          if [ -z "${RAW_KEY}" ]; then
+            if [ -f /root/.ssh/gitea_ci_key ]; then
+              RAW_KEY=$(cat /root/.ssh/gitea_ci_key)
+            elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
+              RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key)
+            fi
+          fi
+
+          if [ -z "${RAW_KEY}" ]; then
+            echo "========================================================================="
+            echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !"
+            echo "========================================================================="
+            exit 1
+          fi
+
+          KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n')
+          SCRIPT_B64=$(base64 scripts/backup_db.sh | tr -d '\r\n')
+          [ -f .env ] && ENV_B64=$(base64 .env | tr -d '\r\n') || ENV_B64=""
 
           docker run --rm --net=host \
-            -v "$(pwd):/workspace" -w /workspace \
-            -v "/root/.ssh:/root/.ssh:ro" \
             -e TARGET_HOST="${TARGET_HOST}" \
             -e TARGET_USER="${TARGET_USER}" \
             -e PORT="${PORT}" \
             -e DEST_DIR="${DEST_DIR}" \
+            -e KEY_B64="${KEY_B64}" \
+            -e SCRIPT_B64="${SCRIPT_B64}" \
+            -e ENV_B64="${ENV_B64}" \
             alpine:latest sh -c '
-              apk add --no-cache openssh-client rsync && \
+              apk add --no-cache openssh-client rsync coreutils && \
-              mkdir -p ~/.ssh && \
+              (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \
-              cp /root/.ssh/gitea_ci_key ~/.ssh/id_rsa && \
+              HEADER=$(grep "BEGIN" /tmp/raw_key) && \
-              chmod 600 ~/.ssh/id_rsa && \
+              FOOTER=$(grep "END" /tmp/raw_key) && \
-              SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
+              BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \
-              echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \
+              printf "%s\n" "$HEADER" > /tmp/working_key && \
+              printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \
+              printf "%s\n" "$FOOTER" >> /tmp/working_key && \
+              echo "" >> /tmp/working_key && \
+              chmod 600 /tmp/working_key && \
+              (echo "$SCRIPT_B64" | base64 -d 2>/dev/null || echo "$SCRIPT_B64" | base64 --decode) > /tmp/backup_db.sh && \
+              if [ -n "$ENV_B64" ]; then \
+                (echo "$ENV_B64" | base64 -d 2>/dev/null || echo "$ENV_B64" | base64 --decode) > /tmp/.env ; \
+              else \
+                touch /tmp/.env ; \
+              fi && \
+              echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
+              echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
+              echo "Destination Directory: ${DEST_DIR}" && \
+              echo "=== 🔑 KEY FINGERPRINT ===" && \
+              ssh-keygen -l -f /tmp/working_key && \
+              SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
+              echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
-              rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
+              echo "=== 📦 RSYNC TRANSFER SCRIPT & ENV ===" && \
-              rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
+              rsync -avz -e "$SSH_CMD" /tmp/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/backup_db.sh" && \
+              rsync -avz -e "$SSH_CMD" /tmp/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
-              echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
+              echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
             '