通过Cloudflared Tunnel在GitHub Action中连接VPS失败求助

问题原因 #

GitHub Action使用的Ubuntu运行环境是临时创建的全新容器，首次SSH连接VPS时，SSH客户端会检查目标主机的密钥是否存在于本地~/.ssh/known_hosts中。由于环境中没有预先存储VPS的主机密钥，直接触发Host key verification failed错误。

解决方案 #

提供两种可行的解决方式，按需选择：

方式1：临时跳过主机密钥验证（CI环境适配） #

在SSH命令中添加StrictHostKeyChecking=no和UserKnownHostsFile=/dev/null参数，跳过主机密钥验证，适合CI/CD这类临时运行环境。

修改后的完整GitHub Action配置：

name: Cloudflared Tunnel

on:
  push:
    branches:
      - main  # 根据需求修改监听分支

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4  # 建议使用最新版本提升稳定性

    - name: Install cloudflared
      run: |
        curl -L https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-archive-keyring.gpg >/dev/null
        echo "deb [signed-by=/usr/share/keyrings/cloudflare-archive-keyring.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list
        sudo apt update && sudo apt-get install -y cloudflared

    - name: Configure SSH key
      run: |
        mkdir -p ~/.ssh
        echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
        chmod 600 ~/.ssh/id_rsa

    - name: SSH into VPS via Cloudflared Tunnel & Execute Deploy Commands
      run: |
        ssh -i ~/.ssh/id_rsa \
            -o StrictHostKeyChecking=no \
            -o UserKnownHostsFile=/dev/null \
            -o ProxyCommand="cloudflared access ssh --hostname ${{ secrets.VPS_HOST }}" \
            ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} "echo 'Connected via Cloudflared Tunnel'; cd /path/to/your/project; git pull; docker-compose up -d"

方式2：预先添加VPS主机密钥到known_hosts（更安全） #

1. 本地执行ssh-keyscan -H your-vps-hostname获取VPS的主机公钥
2. 将获取到的公钥内容添加到GitHub Secrets，命名为VPS_HOST_KEY
3. 在GitHub Action步骤中，将该密钥写入~/.ssh/known_hosts

修改后的相关步骤片段：

- name: Configure SSH environment
      run: |
        mkdir -p ~/.ssh
        echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
        echo "${{ secrets.VPS_HOST_KEY }}" >> ~/.ssh/known_hosts
        chmod 600 ~/.ssh/id_rsa
        chmod 644 ~/.ssh/known_hosts

    - name: SSH into VPS via Cloudflared Tunnel & Execute Deploy Commands
      run: |
        ssh -i ~/.ssh/id_rsa \
            -o ProxyCommand="cloudflared access ssh --hostname ${{ secrets.VPS_HOST }}" \
            ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} "echo 'Connected via Cloudflared Tunnel'; cd /path/to/your/project; git pull; docker-compose up -d"

额外优化提示 #

• 升级actions/checkout到最新版本，避免旧版本潜在问题
• 安装cloudflared时添加-y参数，跳过交互式确认环节
• 确保SSH_PRIVATE_KEY为无密码密钥，CI环境不推荐使用带密码的密钥
• VPS端需确认SSH服务允许该密钥登录，且执行命令的用户拥有git和Docker操作权限

内容的提问来源于stack exchange，提问作者user23306241