build fix 8

.gitea/workflows/build-and-deploy.yml

@@ -160,8 +160,13 @@ jobs:
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
           if [ -n "$VPS_SSH_KEY_B64" ]; then
             if ! printf '%s' "$VPS_SSH_KEY_B64" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_rsa 2>/tmp/vps_ssh_key_decode.err; then
-              echo "::warning::VPS_SSH_KEY_B64 is not valid base64; trying it as a raw private key value"
-              printf '%b\n' "$VPS_SSH_KEY_B64" | tr -d '\r' > ~/.ssh/id_rsa
+              if [ -n "$VPS_SSH_KEY" ]; then
+                echo "::warning::VPS_SSH_KEY_B64 is not valid base64; using VPS_SSH_KEY instead"
+                printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa
+              else
+                echo "::error::VPS_SSH_KEY_B64 is not valid base64. Store a base64-encoded private key there, or set VPS_SSH_KEY to the raw private key."
+                exit 1
+              fi
             fi
           else
             printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa
@@ -376,8 +381,13 @@ jobs:
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
           if [ -n "$VPS_SSH_KEY_B64" ]; then
             if ! printf '%s' "$VPS_SSH_KEY_B64" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_rsa 2>/tmp/vps_ssh_key_decode.err; then
-              echo "::warning::VPS_SSH_KEY_B64 is not valid base64; trying it as a raw private key value"
-              printf '%b\n' "$VPS_SSH_KEY_B64" | tr -d '\r' > ~/.ssh/id_rsa
+              if [ -n "$VPS_SSH_KEY" ]; then
+                echo "::warning::VPS_SSH_KEY_B64 is not valid base64; using VPS_SSH_KEY instead"
+                printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa
+              else
+                echo "::error::VPS_SSH_KEY_B64 is not valid base64. Store a base64-encoded private key there, or set VPS_SSH_KEY to the raw private key."
+                exit 1
+              fi
             fi
           else
             printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa

docs/DOCKER.md

@@ -222,6 +222,7 @@ VPS_SSH_KEY=<deployment-private-key>
 `VPS_IP` overrides the workflow's default `DEPLOY_SSH_HOST`. If `VPS_IP` is not set, the workflow uses `DEPLOY_SSH_HOST` from `.gitea/workflows/build-and-deploy.yml`.
 
 `VPS_SSH_KEY` must be an unencrypted private key that OpenSSH can read in a non-interactive job. The workflow also accepts `VPS_SSH_KEY_B64` when you prefer storing a base64-encoded private key as a single line.
+If both are set, `VPS_SSH_KEY_B64` is used first; when it is not valid base64, the workflow falls back to `VPS_SSH_KEY`.
 
 Supported private key formats: