ci: security improvements

.gitlab-ci.yml

@@ -79,6 +79,7 @@ deploy:
     - if: $CI_COMMIT_REF_NAME == "master"
   variables:
     SSH_ADDRESS: $SSH_USER@$SSH_HOST
+    SSH_PRIVATE_KEY_BASE64: $SSH_PRIVATE_KEY_BASE64
   environment:
     name: production
     url: https://datarush.itqdev.xyz
@@ -86,7 +87,7 @@ deploy:
     - mkdir -p ~/.ssh
     - chmod 700 ~/.ssh
     - echo -e "Host *\n\tStrictHostKeyChecking no\n\tIdentitiesOnly yes\n\n" > ~/.ssh/config
-    - printf "%s\n" "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
+    - echo "$SSH_PRIVATE_KEY_BASE64" | base64 -d > ~/.ssh/id_rsa
     - chmod 600 ~/.ssh/id_rsa
     - ssh-keyscan -H $SSH_HOST -p $SSH_PORT > /dev/null 2>&1
 
@@ -101,10 +102,10 @@ deploy:
       ssh -p $SSH_PORT $SSH_ADDRESS > /dev/null 2>&1 <<'EOF'
       cd ~/deploy
 
-      docker system prune --force > deploy.log 2>&1
-
       docker compose pull --policy always -q > deploy.log 2>&1
       docker compose up -d --remove-orphans --force-recreate >> deploy.log 2>&1
       docker compose ps >> deploy.log 2>&1
+
+      nohup docker system prune --force >> deploy.log 2>&1 &
       EOF
   retry: 2