security: harden CI pipeline (pin host keys, suppress ntfy topic, restrict secrets)

.gitea/workflows/deploy.yml

@@ -7,7 +7,7 @@ jobs:
   deploy:
     runs-on: nix
     env:
-      GIT_SSH_COMMAND: "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=no"
+      GIT_SSH_COMMAND: "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
     steps:
       - uses: https://github.com/actions/checkout@v4
         with:
@@ -25,12 +25,12 @@ jobs:
         run: |
           eval $(ssh-agent -s)
           ssh-add /run/agenix/ci-deploy-key
-          nix run github:serokell/deploy-rs -- .#muffin --skip-checks --ssh-opts="-o StrictHostKeyChecking=no"
+          nix run github:serokell/deploy-rs -- .#muffin --skip-checks --ssh-opts="-o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
 
       - name: Health check
         run: |
           sleep 10
-          ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=no root@server-public \
+          ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts root@server-public \
             "systemctl is-active gitea && systemctl is-active caddy && systemctl is-active continuwuity && systemctl is-active coturn"
 
       - name: Notify success
@@ -38,7 +38,7 @@ jobs:
         run: |
           TOPIC=$(cat /run/agenix/ntfy-alerts-topic | tr -d '[:space:]')
           TOKEN=$(cat /run/agenix/ntfy-alerts-token | tr -d '[:space:]')
-          curl -sf -X POST \
+          curl -sf -o /dev/null -X POST \
             "https://ntfy.sigkill.computer/$TOPIC" \
             -H "Authorization: Bearer $TOKEN" \
             -H "Title: [muffin] Deploy succeeded" \
@@ -51,7 +51,7 @@ jobs:
         run: |
           TOPIC=$(cat /run/agenix/ntfy-alerts-topic 2>/dev/null | tr -d '[:space:]')
           TOKEN=$(cat /run/agenix/ntfy-alerts-token 2>/dev/null | tr -d '[:space:]')
-          curl -sf -X POST \
+          curl -sf -o /dev/null -X POST \
             "https://ntfy.sigkill.computer/$TOPIC" \
             -H "Authorization: Bearer $TOKEN" \
             -H "Title: [muffin] Deploy FAILED" \