Advanced Infrastructure Automation: Building a CI/CD Pipeline for Continuous Deployment

The Necessity of Automated Delivery

Connecting to a server via SSH to manually pull code repositories and restart services introduces configuration drift and unnecessary downtime. A Continuous Integration and Continuous Deployment (CI/CD) pipeline eliminates these risks by strictly automating the testing, building, and delivery of code. This guide details the configuration of a deployment pipeline using GitHub Actions to deploy an application securely to a production KVM VPS. Before allowing any automated runner to access your production environment, you must enforce strict access controls as outlined in our Securing Your Server guide.

Configuring Dedicated Authentication

The automated runner requires authenticated access to your server. You must never use your personal administrative keys for automated pipelines. The first step is generating a dedicated SSH key pair exclusively for the deployment process. Execute this command on your secure local machine to generate an Ed25519 key pair:

ssh-keygen -t ed25519 -C "github-actions-deploy" -f ./deploy_key

You must append the generated public key to the authorized_keys file of the deployment user on your CLOUD HIVE DC server. The private key must be stored securely as an encrypted secret within your GitHub repository settings, along with the server IP address and username.

Defining the Declarative Workflow

With authentication established, you must define the pipeline workflow. Create a YAML file within your repository directory at .github/workflows/deploy.yml. This declarative configuration specifies the exact triggers and the sequence of commands the runner will execute. Open your code editor and insert the following pipeline definition:

name: Production Deployment

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Execute Remote SSH Commands
        uses: appleboy/ssh-action@v0.1.6
        with:
          host: ${{ secrets.SERVER_IP }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_PRIVATE_KEY }}
          script: |
            cd /var/www/application
            git pull origin main
            npm install
            pm2 restart app

Executing the Automated Deployment

Once you commit and push this YAML file to your repository, the pipeline becomes active. Every time new code is merged into the main branch, the GitHub Actions runner automatically provisions a secure container, authenticates with your CLOUD HIVE DC server via SSH, pulls the latest commit, installs necessary dependencies, and restarts the application daemon. This process ensures absolute consistency across deployments and completely removes manual intervention from the release cycle.