SSH for Beginners: Log In to a Linux Server With a Key

      - name: Deploy over SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.VPS_SSH_HOST }}
          username: ${{ secrets.VPS_SSH_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ vars.VPS_SSH_PORT || 22 }}
          script: |
            set -euo pipefail
            cd "${{ vars.DEPLOY_PATH }}"

The deploy job's SSH step. Host, user and private key come from encrypted secrets, and the port from a variable that falls back to 22, so no address or user name is written in the repository. set -euo pipefail stops the remote script at the first failing command, so a failed cd can never run the commands that follow in the wrong folder.

            # Write runtime env from GitHub Secrets/Variables. Quoted heredoc so
            # shell does not expand anything in the (already-rendered) values.
            cat > .env <<'ENVEOF'
            GROQ_API_KEY=${{ secrets.GROQ_API_KEY }}
            RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}
            CONTACT_FROM_EMAIL=${{ vars.CONTACT_FROM_EMAIL }}
            CONTACT_TO_EMAIL=${{ vars.CONTACT_TO_EMAIL }}
            IMAGE=${{ needs.build-and-push.outputs.image }}
            APP_PORT=${{ vars.APP_PORT || 3002 }}
            ENVEOF
            chmod 600 .env

What the SSH session does first. The quoted heredoc marker, <<'ENVEOF', stops the server's shell from expanding anything inside the values GitHub has already filled in. chmod 600 then makes the file readable and writable by its owner only, the same mode SSH asks of authorized_keys.

RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs

The same least-privilege idea, inside the container. The final stage creates a system user with uid 1001, gives it ownership of the app files, and switches to it with USER before the app starts, so the Node process never runs as root.