{"id":4339,"date":"2026-09-12T16:11:54","date_gmt":"2026-09-12T10:41:54","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-deploy-web-apps-github-actions-linux-vps-ssh\/"},"modified":"2026-09-12T16:11:54","modified_gmt":"2026-09-12T10:41:54","slug":"how-to-deploy-web-apps-github-actions-linux-vps-ssh","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-deploy-web-apps-github-actions-linux-vps-ssh\/","title":{"rendered":"How to Deploy Web Apps from GitHub Actions to Linux VPS via SSH"},"content":{"rendered":"

Continuous Integration and Continuous Deployment (CI\/CD) eliminates repetitive manual deployments, human configuration errors, and unexpected downtime. While managed cloud platforms offer convenient git-push integrations, deploying directly to your own self-hosted Linux VPS<\/a> provides complete hardware ownership, unlimited deployment frequency, and drastically lower infrastructure costs.<\/p>\n

In this guide, you will learn how to architect an automated, production-grade deployment pipeline using GitHub Actions<\/strong> and SSH keys<\/strong>. We will establish dedicated deployment users, configure hardened cryptographic authentication, deploy code using atomic symlinks and rsync<\/code>, and reload production services without dropping client connections.<\/p>\n

1. The Production CI\/CD Deployment Architecture<\/h2>\n

A resilient CI\/CD pipeline separates build-time validation from deployment orchestration. Below is the end-to-end execution workflow:<\/p>\n

    \n
  1. A developer merges code into the main<\/code> production branch.<\/li>\n
  2. GitHub Actions triggers an ephemeral runner to execute automated linting, security scanning, and unit tests.<\/li>\n
  3. Upon passing tests, the runner establishes an encrypted SSH connection to your remote VPS using an isolated deployment key.<\/li>\n
  4. The runner synchronizes release artifacts using rsync<\/code> into a versioned release folder.<\/li>\n
  5. The pipeline executes database migrations, switches an atomic symlink to point to the new release, and reloads systemd or Docker services in zero downtime.<\/li>\n<\/ol>\n

    2. Configuring a Hardened Deploy User on Linux VPS<\/h2>\n

    Never execute CI\/CD deployments using the root<\/code> administrative account. If an attacker compromises your repository secrets or a malicious pull request slips through, they gain unrestricted root privileges across your server. Instead, create an isolated deploy user with tightly constrained sudo permissions:<\/p>\n

    # Create an unprivileged deploy user\nsudo adduser --disabled-password --gecos \"\" deployer\n\n# Create SSH configuration directory\nsudo mkdir -p \/home\/deployer\/.ssh\nsudo chmod 700 \/home\/deployer\/.ssh\n\n# Configure target release web directory\nsudo mkdir -p \/var\/www\/my-app\/releases\nsudo mkdir -p \/var\/www\/my-app\/shared\nsudo chown -R deployer:deployer \/var\/www\/my-app<\/code><\/pre>\n
    Next, grant the deployer<\/code> user permission to reload your web server or systemd services without requesting an interactive password:<\/p>\n
    # Add sudoers rule using visudo\necho \"deployer ALL=(ALL) NOPASSWD: \/bin\/systemctl reload nginx, \/bin\/systemctl restart my-app.service\" | sudo tee \/etc\/sudoers.d\/deployer-service-reload<\/code><\/pre>\n
    3. Generating and Securing Ed25519 SSH Keys<\/h2>\n
    Generate a modern Ed25519 SSH keypair on your local administrative machine specifically for GitHub Actions deployment:<\/p>\n
    ssh-keygen -t ed25519 -C \"github-actions-deploy\" -f .\/id_deploy_github<\/code><\/pre>\n
    Append the public key (id_deploy_github.pub<\/code>) to the VPS deployer authorized keys:<\/p>\n
    cat .\/id_deploy_github.pub | ssh administrator@your-vps-ip \"sudo tee -a \/home\/deployer\/.ssh\/authorized_keys\"\nssh administrator@your-vps-ip \"sudo chmod 600 \/home\/deployer\/.ssh\/authorized_keys && sudo chown -R deployer:deployer \/home\/deployer\/.ssh\"<\/code><\/pre>\n
    Next, open your GitHub repository, navigate to Settings > Secrets and variables > Actions<\/strong>, and configure the following Repository Secrets:<\/p>\n