From c7d83e47492932de5c7ace1420349ce18d0f57b2 Mon Sep 17 00:00:00 2001
From: Dominic Vos <dominic@qlic.nl>
Date: Mon, 4 Aug 2025 14:24:44 +0000
Subject: [PATCH] Update .gitea/workflows/deploy.yml

---
 .gitea/workflows/deploy.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index c22bd9b..d186947 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -4,6 +4,12 @@ on:
       ssh-private-key:
         required: true
         type: string
+      certificate-pem:
+        required: false
+        type: string
+      private-key-pem:
+        required: false
+        type: string
     inputs:
       image:
         required: false
@@ -70,6 +76,29 @@ jobs:
       - name: Append kamal registry password
         run: echo "KAMAL_REGISTRY_PASSWORD=${{ inputs.password }}" >> .kamal/secrets.${{ inputs.environment }}
 
+      - name: Add optional PEM secrets to .env
+        run: |
+          ENV_FILE=".kamal/secrets.${{ inputs.environment }}"
+
+          # Add certificate-pem if present
+          if [[ -n "${{ secrets.certificate-pem }}" ]]; then
+            {
+              echo "";
+              echo "CERTIFICATE_PEM='";
+              echo "${{ secrets.certificate-pem }}";
+              echo "'";
+            } >> "$ENV_FILE"
+          fi
+
+          if [[ -n "${{ secrets.private-key-pem }}" ]]; then
+            {
+              echo "";
+              echo "PRIVATE_KEY_PEM='";
+              echo "${{ secrets.private-key-pem }}";
+              echo "'";
+            } >> "$ENV_FILE"
+          fi
+
       - name: Boot accessories
         run: kamal accessory reboot all -d ${{ inputs.environment }}