diff --git a/.gitea/actions/configure-homelab-ssh/action.yml b/.gitea/actions/configure-homelab-ssh/action.yml
new file mode 100644
index 0000000..b66cf6a
--- /dev/null
+++ b/.gitea/actions/configure-homelab-ssh/action.yml
@@ -0,0 +1,102 @@
+name: 'Configure Homelab SSH'
+description: 'Fetches SSH keys from Infisical and configures SSH config with a jump host'
+inputs:
+  infisical_cicd_token:
+    description: 'Infisical Service Token for CI/CD secrets'
+    required: true
+  infisical_api_url:
+    description: 'Infisical API URL (for self-hosted instances)'
+    required: false
+    default: 'https://secrets.itlab-ffeks.dnu.edu.ua'
+  infisical_env:
+    description: 'Infisical Environment (defaults to Gitea branch/ref name)'
+    required: false
+    default: ''
+  jump_host:
+    description: 'Jump host IP or hostname'
+    required: false
+    default: '212.3.125.242'
+  jump_port:
+    description: 'Jump host SSH port'
+    required: false
+    default: '2222'
+  jump_user:
+    description: 'Jump host SSH username'
+    required: false
+    default: 'jump'
+  vm_ip:
+    description: 'Target VM IP'
+    required: true
+  vm_port:
+    description: 'Target VM SSH port'
+    required: false
+    default: '22'
+  vm_user:
+    description: 'Target VM SSH username'
+    required: false
+    default: 'debian'
+  ssh_host_alias:
+    description: 'Alias for target VM in SSH config'
+    required: false
+    default: 'vm'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install Infisical CLI
+      shell: bash
+      run: |
+        if ! command -v infisical &> /dev/null; then
+          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
+          sudo apt-get update && sudo apt-get install -y infisical
+        else
+          echo "Infisical CLI already installed"
+        fi
+
+    - name: Configure SSH
+      shell: bash
+      run: |
+        mkdir -p ~/.ssh
+        chmod 700 ~/.ssh
+
+        export INFISICAL_TOKEN="${{ inputs.infisical_cicd_token }}"
+        export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
+        export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+        export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+        INFISICAL_ENV="${{ inputs.infisical_env }}"
+        if [ -z "$INFISICAL_ENV" ]; then
+          INFISICAL_ENV="${{ gitea.ref_name }}"
+        fi
+
+        echo "Fetching SSH keys from Infisical..."
+        JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --env="$INFISICAL_ENV" --plain)
+        VM_KEY=$(infisical secrets get VM_SSH_KEY --env="$INFISICAL_ENV" --plain)
+
+        if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
+          echo "Error: SSH keys retrieved from Infisical are empty!" >&2
+          exit 1
+        fi
+
+        echo "$JUMP_KEY" > ~/.ssh/jump_key
+        chmod 600 ~/.ssh/jump_key
+
+        echo "$VM_KEY" > ~/.ssh/vm_key
+        chmod 600 ~/.ssh/vm_key
+
+        cat > ~/.ssh/config <<EOF
+        Host jump
+          HostName ${{ inputs.jump_host }}
+          User ${{ inputs.jump_user }}
+          Port ${{ inputs.jump_port }}
+          IdentityFile ~/.ssh/jump_key
+          StrictHostKeyChecking no
+
+        Host ${{ inputs.ssh_host_alias }}
+          HostName ${{ inputs.vm_ip }}
+          User ${{ inputs.vm_user }}
+          Port ${{ inputs.vm_port }}
+          IdentityFile ~/.ssh/vm_key
+          ProxyJump jump
+          StrictHostKeyChecking no
+        EOF
diff --git a/.gitea/workflows/deploy-caddy.yml b/.gitea/workflows/deploy-caddy.yml
index eaa93e2..1acfb53 100644
--- a/.gitea/workflows/deploy-caddy.yml
+++ b/.gitea/workflows/deploy-caddy.yml
@@ -35,6 +35,11 @@ on:
         required: false
         default: "https://secrets.itlab-ffeks.dnu.edu.ua"
 
+      infisical_env:
+        description: "Infisical Environment"
+        type: string
+        required: false
+
     secrets:
       infisical_cicd_token:
         description: "Infisical Service Token for CI/CD secrets"
@@ -46,52 +51,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Install Infisical CLI
-        run: |
-          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
-          sudo apt-get update && sudo apt-get install -y infisical
-
       - name: Configure SSH
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-
-          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
-          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
-          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
-          export INFISICAL_DISABLE_UPDATE_CHECK=true
-
-          echo "Fetching SSH keys from Infisical..."
-          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
-          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
-
-          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
-            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
-            exit 1
-          fi
-
-          echo "$JUMP_KEY" > ~/.ssh/jump_key
-          chmod 600 ~/.ssh/jump_key
-
-          echo "$VM_KEY" > ~/.ssh/vm_key
-          chmod 600 ~/.ssh/vm_key
-
-          cat > ~/.ssh/config <<EOF
-          Host jump
-            HostName ${{ inputs.jump_host }}
-            User ${{ inputs.jump_user }}
-            Port ${{ inputs.jump_port }}
-            IdentityFile ~/.ssh/jump_key
-            StrictHostKeyChecking no
-
-          Host caddy
-            HostName ${{ inputs.vm_ip }}
-            User ${{ inputs.vm_user }}
-            Port ${{ inputs.vm_port }}
-            IdentityFile ~/.ssh/vm_key
-            ProxyJump jump
-            StrictHostKeyChecking no
-          EOF
+        uses: ./.gitea/actions/configure-homelab-ssh
+        with:
+          infisical_cicd_token: ${{ secrets.infisical_cicd_token }}
+          infisical_api_url: ${{ inputs.infisical_api_url }}
+          infisical_env: ${{ inputs.infisical_env }}
+          jump_host: ${{ inputs.jump_host }}
+          jump_port: ${{ inputs.jump_port }}
+          jump_user: ${{ inputs.jump_user }}
+          vm_ip: ${{ inputs.vm_ip }}
+          vm_port: ${{ inputs.vm_port }}
+          vm_user: ${{ inputs.vm_user }}
+          ssh_host_alias: caddy
 
 
       - name: Upload Caddyfile
diff --git a/.gitea/workflows/deploy-docker-compose.yml b/.gitea/workflows/deploy-docker-compose.yml
index 946d9a9..555c67c 100644
--- a/.gitea/workflows/deploy-docker-compose.yml
+++ b/.gitea/workflows/deploy-docker-compose.yml
@@ -39,7 +39,7 @@ on:
       infisical_env:
         description: "Infisical Environment"
         type: string
-        required: true
+        required: false
 
       infisical_path:
         description: "Infisical secret path"
@@ -69,52 +69,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Infisical CLI
-        run: |
-          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
-          sudo apt-get update && sudo apt-get install -y infisical
-
       - name: Configure SSH
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-
-          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
-          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
-          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
-          export INFISICAL_DISABLE_UPDATE_CHECK=true
-
-          echo "Fetching SSH keys from Infisical..."
-          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
-          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
-
-          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
-            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
-            exit 1
-          fi
-
-          echo "$JUMP_KEY" > ~/.ssh/jump_key
-          chmod 600 ~/.ssh/jump_key
-
-          echo "$VM_KEY" > ~/.ssh/vm_key
-          chmod 600 ~/.ssh/vm_key
-
-          cat > ~/.ssh/config <<EOF
-          Host jump
-            HostName ${{ inputs.jump_host }}
-            User ${{ inputs.jump_user }}
-            Port ${{ inputs.jump_port }}
-            IdentityFile ~/.ssh/jump_key
-            StrictHostKeyChecking no
-
-          Host vm
-            HostName ${{ inputs.vm_ip }}
-            User ${{ inputs.vm_user }}
-            Port ${{ inputs.vm_port }}
-            IdentityFile ~/.ssh/vm_key
-            ProxyJump jump
-            StrictHostKeyChecking no
-          EOF
+        uses: ./.gitea/actions/configure-homelab-ssh
+        with:
+          infisical_cicd_token: ${{ secrets.infisical_cicd_token }}
+          infisical_api_url: ${{ inputs.infisical_api_url }}
+          infisical_env: ${{ inputs.infisical_env }}
+          jump_host: ${{ inputs.jump_host }}
+          jump_port: ${{ inputs.jump_port }}
+          jump_user: ${{ inputs.jump_user }}
+          vm_ip: ${{ inputs.vm_ip }}
+          vm_port: ${{ inputs.vm_port }}
+          vm_user: ${{ inputs.vm_user }}
+          ssh_host_alias: vm
 
       - name: Test SSH connection to VM
         run: |
@@ -136,6 +103,9 @@ jobs:
             export INFISICAL_DISABLE_UPDATE_CHECK=true
 
             INFISICAL_ENV="${{ inputs.infisical_env }}"
+            if [ -z "$INFISICAL_ENV" ]; then
+              INFISICAL_ENV="${{ gitea.ref_name }}"
+            fi
             INFISICAL_PATH="${{ inputs.infisical_path }}"
 
             echo "Running docker compose down and up under Infisical..."
diff --git a/.gitea/workflows/deploy-infrastructure.yml b/.gitea/workflows/deploy-infrastructure.yml
index d414404..ab38832 100644
--- a/.gitea/workflows/deploy-infrastructure.yml
+++ b/.gitea/workflows/deploy-infrastructure.yml
@@ -11,6 +11,10 @@ on:
         type: string
         required: false
         default: "https://secrets.itlab-ffeks.dnu.edu.ua"
+      infisical_env:
+        description: "Infisical Environment"
+        type: string
+        required: false
     secrets:
       infisical_cicd_token:
         description: "Infisical Service Token for CI/CD secrets"
@@ -49,10 +53,15 @@ jobs:
           export INFISICAL_DOMAIN="$INFISICAL_API_URL"
           export INFISICAL_DISABLE_UPDATE_CHECK=true
 
+          INFISICAL_ENV="${{ inputs.infisical_env }}"
+          if [ -z "$INFISICAL_ENV" ]; then
+            INFISICAL_ENV="${{ gitea.ref_name }}"
+          fi
+
           # Fetch secrets (assuming CLI is pre-installed)
           echo "Fetching secrets from Infisical..."
-          PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --plain)
-          INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --plain)
+          PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --env="$INFISICAL_ENV" --plain)
+          INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --env="$INFISICAL_ENV" --plain)
 
           # Mask values in logs immediately
           echo "::add-mask::$PROXMOX_VE_API_TOKEN"