Letting the server pull from a private repository.
WHY A DEPLOY KEY
A deploy key grants read access to one repository. It is safer than putting your personal credentials on a server, because it cannot be used to reach anything else.
GENERATING ONE
Generate an SSH key pair on the server, in your home directory. Do not set a passphrase, since automated pulls cannot supply one.
ADDING IT TO THE REPOSITORY
Copy the public key and add it as a deploy key in the repository's settings on GitHub, GitLab or wherever it is hosted.
Grant read-only access unless the server genuinely needs to push, which it usually does not.
TESTING
From SSH, attempt a clone or pull. The first connection asks you to confirm the host fingerprint.
SECURITY
A deploy key on the server means anyone with access to the server can read that repository. Keep the private key permissions at 600.
Use a separate key per server rather than reusing one.
REVOKING
Remove the key from the repository settings when the server no longer needs access.
