big update

.gitea/workflows/deploy-caddy.yml

@@ -29,11 +29,15 @@ on:
         type: string
         default: "debian"
 
-    secrets:
-      jump_ssh_key:
-        required: true
+      infisical_api_url:
+        description: "Infisical API URL (for self-hosted instances)"
+        type: string
+        required: false
+        default: "https://secrets.itlab-ffeks.dnu.edu.ua"
 
-      vm_ssh_key:
+    secrets:
+      infisical_cicd_token:
+        description: "Infisical Service Token for CI/CD secrets"
         required: true
 
 
@@ -50,13 +54,26 @@ jobs:
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
 
-          echo "${{ secrets.jump_ssh_key }}" > ~/.ssh/jump_key
+          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
+          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
+          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+          export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+          echo "Fetching SSH keys from Infisical..."
+          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
+          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
+
+          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
+            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
+            exit 1
+          fi
+
+          echo "$JUMP_KEY" > ~/.ssh/jump_key
           chmod 600 ~/.ssh/jump_key
 
-          echo "${{ secrets.vm_ssh_key }}" > ~/.ssh/vm_key
+          echo "$VM_KEY" > ~/.ssh/vm_key
           chmod 600 ~/.ssh/vm_key
 
-
           cat > ~/.ssh/config <<EOF
           Host jump
             HostName ${{ inputs.jump_host }}