refactor(infra): use secrets

.gitea/workflows/upload-infrastructure.yml

@@ -3,32 +3,6 @@ name: Upload Infrastructure
 on:
   workflow_call:
     inputs:
-      host:
-        description: "IP address or hostname of the remote destination server"
-        required: true
-        type: string
-      user:
-        description: "SSH username for the remote destination server"
-        required: true
-        type: string
-      port:
-        description: "SSH port for the remote destination server"
-        required: false
-        type: string
-        default: "22"
-      jump_host:
-        description: "IP address or hostname of the SSH jump (bastion) server"
-        required: true
-        type: string
-      jump_user:
-        description: "SSH username for the SSH jump (bastion) server"
-        required: true
-        type: string
-      jump_port:
-        description: "SSH port for the SSH jump (bastion) server"
-        required: false
-        type: string
-        default: "22"
       infrastructure_path:
         description: "Target directory path to run deployment commands inside"
         required: false
@@ -41,6 +15,24 @@ on:
       jump_ssh_key:
         description: "SSH private key for the SSH jump (bastion) server"
         required: true
+      host:
+        description: "IP address or hostname of the remote destination server"
+        required: true
+      user:
+        description: "SSH username for the remote destination server"
+        required: true
+      port:
+        description: "SSH port for the remote destination server"
+        required: false
+      jump_host:
+        description: "IP address or hostname of the SSH jump (bastion) server"
+        required: true
+      jump_user:
+        description: "SSH username for the SSH jump (bastion) server"
+        required: true
+      jump_port:
+        description: "SSH port for the SSH jump (bastion) server"
+        required: false
 
 jobs:
   deploy:
@@ -50,6 +42,12 @@ jobs:
         env:
           SSH_KEY: ${{ secrets.ssh_key }}
           JUMP_SSH_KEY: ${{ secrets.jump_ssh_key }}
+          TARGET_HOST: ${{ secrets.host }}
+          TARGET_USER: ${{ secrets.user }}
+          TARGET_PORT: ${{ secrets.port || '22' }}
+          JUMP_HOST: ${{ secrets.jump_host }}
+          JUMP_USER: ${{ secrets.jump_user }}
+          JUMP_PORT: ${{ secrets.jump_port || '22' }}
         run: |
           # Create ssh directory and restrict access
           mkdir -p ~/.ssh
@@ -63,17 +61,17 @@ jobs:
           # Create SSH config to handle jump routing, keys, and security bypasses
           cat << EOF > ~/.ssh/config
           Host jump
-            HostName ${{ inputs.jump_host }}
-            User ${{ inputs.jump_user }}
-            Port ${{ inputs.jump_port }}
+            HostName $JUMP_HOST
+            User $JUMP_USER
+            Port $JUMP_PORT
             IdentityFile ~/.ssh/id_jump
             StrictHostKeyChecking no
             UserKnownHostsFile /dev/null
           
           Host target
-            HostName ${{ inputs.host }}
-            User ${{ inputs.user }}
-            Port ${{ inputs.port }}
+            HostName $TARGET_HOST
+            User $TARGET_USER
+            Port $TARGET_PORT
             IdentityFile ~/.ssh/id_rsa
             ProxyJump jump
             StrictHostKeyChecking no