From 55a35c9e262de0a372c959dbe3033bee5f6e7043 Mon Sep 17 00:00:00 2001
From: L HEREEC Kevin INNOV/PTFM <PGZM5392@orange.com>
Date: Mon, 13 Jul 2026 12:34:20 +0200
Subject: [PATCH] ci: replace sshpass with SSH key authentication for NAS
 deploy

---
 .gitea/workflows/build.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 9311812..064b23f 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -52,15 +52,23 @@ jobs:
 
       - name: Deploy on NAS
         run: |
-          apk add --no-cache openssh-client sshpass
+          apk add --no-cache openssh-client
+
+          # Installer la clé privée SSH
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 192.168.1.39 >> ~/.ssh/known_hosts
+
+          SSH="ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no Stude12@192.168.1.39"
 
           # Copier docker-compose.prod.yml sur le NAS
-          cat docker-compose.prod.yml | sshpass -p "${{ secrets.SSHPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 \
+          cat docker-compose.prod.yml | $SSH \
             "mkdir -p /volume1/docker/adam-acs && cat > /volume1/docker/adam-acs/docker-compose.prod.yml"
 
           # Créer le fichier .env sur le NAS à partir des secrets
           # MongoDB mutualisé : connexion hard-codée dans docker-compose.prod.yml (admin/admin_password)
-          sshpass -p "${{ secrets.SSHPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/adam-acs/.env" <<EOF
+          $SSH "cat > /volume1/docker/adam-acs/.env" <<EOF
           APP_KEY=${{ secrets.APP_KEY }}
           APP_URL=${{ secrets.APP_URL }}
           APP_PORT=${{ secrets.APP_PORT }}
@@ -72,7 +80,7 @@ jobs:
           EOF
 
           # Déployer avec docker compose
-          sshpass -p "${{ secrets.SSHPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "
+          $SSH "
             cd /volume1/docker/adam-acs &&
             echo '${{ secrets.SSHPASS }}' | sudo -S /usr/bin/docker login http://192.168.1.39:3000 -u '${{ secrets.USERNAME }}' --password-stdin &&
             echo '${{ secrets.SSHPASS }}' | sudo -S /usr/bin/docker compose -f docker-compose.prod.yml pull &&