An SSH private key is the secret half of an SSH key pair. Keep it private and use it to authenticate secure shell connections without exposing personal credentials. section 4.1.2 section 4.1.5
Use a purpose-built private key when automating deployment:
- Generate a separate key pair for GitHub Actions instead of exposing a personal key. section 4.1.2
- Store the private key as the repository secret SSH_PRIVATE_KEY; install the matching public key on new remote instances. section 4.1.2
- Make the workflow write the secret to ~/.ssh/id_rsa and apply chmod 600 before connecting. section 4.1.5
- Keep the private key out of GitHub Actions logs, repositories, and shared environments. section 4.1.5
Automated NGINX installation
A GitHub Actions workflow injects SSH_PRIVATE_KEY, configures the key with restricted permissions, reads the server address from AKAMAI_INSTANCE_IP_ADDRESS, and runs remote apt commands to install NGINX. section 4.1.5
Listing 4.3 Creating a new SSH key
# windows/mac/linux ssh-keygen -t rsa -b 4096 -f github_actions_key -N ""
Generate a dedicated 4096-bit RSA key pair without interactive input. section 4.1.2
Listing 4.4 Installing NGINX with GitHub Actions
name: Install NGINX
on:
workflow_dispatch:
push:
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Configure the SSH Private Key Secret
run: |
mkdir -p ~/.ssh/
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
- name: Set Strict Host Key Checking
run: echo "StrictHostKeyChecking=no" > ~/.ssh/config
- name: Install NGINX
run: |
export MY_HOST="${{ secrets.AKAMAI_INSTANCE_IP_ADDRESS }}"
ssh root@$MY_HOST sudo apt update
ssh root@$MY_HOST sudo apt install nginx -y
See the complete workflow that loads the private key and uses it to install NGINX remotely. section 4.1.5
