how to set up github secret keys and auto deploy on any vps

Continuous deployment is essential for modern development workflows. In this guide, we'll walk through setting up secure auto-deployment from GitHub to your Virtual Private Server (VPS) using GitHub Actions and secret keys.

Why Use GitHub Secrets?

GitHub Secrets allow you to store sensitive information securely in your repository without exposing credentials in your code. This includes:

• SSH private keys
• API tokens
• Database credentials
• Environment variables

By combining GitHub Secrets with GitHub Actions, you can create a fully automated deployment pipeline that triggers whenever you push code to your repository.

Prerequisites

Before we begin, ensure you have:

• A GitHub repository for your project
• A VPS with SSH access (DigitalOcean, Linode, AWS EC2, etc.)
• Basic familiarity with terminal commands
• Git installed locally and on your VPS

Step 1: Generate SSH Key Pair

First, generate an SSH key pair that will be used for secure communication between GitHub and your VPS.

On your local machine, run:

bashssh-keygen -t ed25519 -C "github-actions-deploy" -f ~/.ssh/github_deploy_key

This creates two files:

• github_deploy_key (private key) - stays with GitHub
• github_deploy_key.pub (public key) - goes on your VPS

Important: Never share or commit your private key. GitHub Secrets will keep it secure.

Step 2: Configure Your VPS

Add the Public Key to Your VPS

Copy the public key to your VPS's authorized keys:

bashssh-copy-id -i ~/.ssh/github_deploy_key.pub user@your-vps-ip

Alternatively, manually add it:

bashcat ~/.ssh/github_deploy_key.pub

Then on your VPS:

bashmkdir -p ~/.ssh
echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Prepare Your Deployment Directory

On your VPS, create and configure the deployment directory:

bashmkdir -p /var/www/your-app
chown -R $USER:$USER /var/www/your-app

Step 3: Add Secrets to GitHub

Navigate to your GitHub repository and add the necessary secrets:

1. Go to Settings → Secrets and variables → Actions
2. Click New repository secret
3. Add the following secrets:

Required Secrets

SSH_PRIVATE_KEY

bashcat ~/.ssh/github_deploy_key

Copy the entire output (including -----BEGIN and -----END lines) and paste it as the secret value.

VPS_HOST

your-vps-ip-address

Your VPS IP address or domain name.

VPS_USERNAME

your-username

The SSH user on your VPS (often root, ubuntu, or deploy).

Optional Secrets

VPS_PORT

22

SSH port (default is 22).

DEPLOY_PATH

/var/www/your-app

The absolute path where your application will be deployed.

Step 4: Create GitHub Actions Workflow

Create a workflow file in your repository at .github/workflows/deploy.yml:

yamlname: Deploy to VPS

on:
  push:
    branches:
      - main
      - production

jobs:
  deploy:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.VPS_HOST }} >> ~/.ssh/known_hosts
          
      - name: Deploy to VPS
        env:
          HOST: ${{ secrets.VPS_HOST }}
          USERNAME: ${{ secrets.VPS_USERNAME }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
        run: |
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $USERNAME@$HOST << 'EOF'
            cd ${{ secrets.DEPLOY_PATH }}
            git pull origin main
            
            # Install dependencies (adjust for your stack)
            npm install --production
            
            # Build your application
            npm run build
            
            # Restart your application service
            pm2 restart your-app || pm2 start npm --name "your-app" -- start
          EOF

Step 5: Advanced Deployment Strategies

Using rsync for File Transfer

For projects without Git on the VPS, use rsync:

yaml- name: Deploy via rsync
  run: |
    rsync -avz -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \
      --exclude '.git' \
      --exclude 'node_modules' \
      ./ ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:${{ secrets.DEPLOY_PATH }}

Docker-based Deployment

For containerized applications:

yaml- name: Build and deploy Docker container
  run: |
    ssh -i ~/.ssh/deploy_key $USERNAME@$HOST << 'EOF'
      cd ${{ secrets.DEPLOY_PATH }}
      git pull origin main
      docker-compose down
      docker-compose up -d --build
    EOF

Zero-Downtime Deployment

Implement blue-green deployment pattern:

yaml- name: Blue-Green Deployment
  run: |
    ssh -i ~/.ssh/deploy_key $USERNAME@$HOST << 'EOF'
      # Deploy to staging directory
      cd /var/www/staging
      git pull origin main
      npm install && npm run build
      
      # Run tests
      npm test
      
      # Swap directories atomically
      mv /var/www/production /var/www/backup
      mv /var/www/staging /var/www/production
      
      # Restart service
      sudo systemctl restart your-app
    EOF

Step 6: Testing Your Deployment

Test your setup:

1. Make a small change to your repository
2. Commit and push to the branch specified in your workflow
3. Navigate to Actions tab in your GitHub repository
4. Watch the workflow execute in real-time
5. Verify changes on your VPS

Troubleshooting Common Issues

Permission Denied (publickey)

• Ensure the public key is correctly added to ~/.ssh/authorized_keys on your VPS
• Check file permissions: ~/.ssh (700) and authorized_keys (600)
• Verify the private key in GitHub Secrets is complete and unmodified

Host Key Verification Failed

• Add ssh-keyscan step to your workflow as shown above
• Or use -o StrictHostKeyChecking=no (less secure)

Deployment Script Fails

• Check the DEPLOY_PATH exists and has correct permissions
• Ensure your user has necessary permissions (consider using sudo where needed)
• Review GitHub Actions logs for specific error messages

Application Not Restarting

• Verify your process manager (PM2, systemd, etc.) is configured correctly
• Check service status: systemctl status your-app
• Review application logs for runtime errors

Security Best Practices

1. Use Deployment Keys: Create a dedicated SSH key for deployments, don't reuse personal keys
2. Limit Permissions: Create a dedicated deployment user on your VPS with minimal permissions
3. Restrict Branch Access: Only deploy from protected branches (main, production)
4. Rotate Keys Regularly: Update SSH keys periodically and revoke old ones
5. Use Environment-Specific Secrets: Separate secrets for staging and production environments
6. Enable Two-Factor Authentication: Protect your GitHub account with 2FA
7. Audit Secret Access: Regularly review who has access to repository secrets
8. Use Read-Only Deployment Keys: When possible, use GitHub Deploy Keys with read-only access

Monitoring and Notifications

Slack Notifications

Add Slack notifications to your workflow:

yaml- name: Notify Slack
  if: always()
  uses: 8398a7/action-slack@v3
  with:
    status: ${{ job.status }}
    text: 'Deployment to VPS completed'
    webhook_url: ${{ secrets.SLACK_WEBHOOK }}

Email Notifications

Configure email alerts in repository settings under Notifications for workflow failures.

Health Checks

Add a post-deployment health check:

yaml- name: Health check
  run: |
    sleep 10
    curl --fail https://your-domain.com/health || exit 1

Conclusion

You now have a fully automated deployment pipeline from GitHub to your VPS. Every push to your main branch will trigger a deployment, keeping your VPS synchronized with your repository.

This setup provides:

• ✅ Secure credential management with GitHub Secrets
• ✅ Automated deployments on every push
• ✅ Complete audit trail in GitHub Actions logs
• ✅ Rollback capability through Git history
• ✅ Scalable approach that works with any VPS provider

As your infrastructure grows, consider migrating to more sophisticated solutions like Kubernetes, AWS CodeDeploy, or dedicated CI/CD platforms. However, this GitHub Actions approach provides an excellent balance of simplicity, security, and automation for most projects.

Additional Resources

• GitHub Actions Documentation
• GitHub Encrypted Secrets
• SSH Key Management Best Practices
• Deploying with GitHub Actions

Ready to automate your deployments? Start implementing this workflow today and never manually SSH into your server for deployments again.