DEV Community: Syed Fazil

Deploying on a VPS with GitHub Actions

Syed Fazil — Sat, 20 Jun 2026 09:51:04 +0000

Why I am writing this post

At the beginning of this year, I bought/rented (whatever you want to call it) a VPS to host my personal projects, and I learned a lot by setting it up and managing it.

I have been making some small tools that I think are useful for me, and each of them goes through iterations.

At each iteration,

I check the code
Commit my changes
Push them to GitHub
SSH into my VPS
Navigate to the project directory
Pull the latest code
Run docker compose up -d --build to deploy the changes.

But me being lazy as I am, I often end up not even making the changes I want to make because I don't like to go through this just following a set flow approach.

There are a few reasons:

I learnt nothing new mostly
There is a delay in response from the VPS when I type any character
Most importantly, it is something I know can be easily automated

Having worked with CI/CD pipelines with GitLab at work, I am aware that this repetitive work can be reduced to just a single command.

git push

Now, for my personal projects, like millions of developers around the world, I use GitHub

And I know there is a CI/CD thingy called GitHub Actions, so this is my attempt at both learning and using GitHub Actions to make my life easier

Let's begin

Enable Actions in the project

To use actions, we go to the repository in GitHub and select the "Settings" tab.

Click on the “Actions” dropdown and the “General” option.

Select “Allow fazil-syed and select non-fazil-syed actions and reusable workflows”

and check

Allow actions created by GitHub
Allow actions by Marketplace

I am choosing this option for security reasons so no malicious action gets accidentally run.

and save.

Setting up GitHub variables

So how will GitHub (runner) do anything on my VPS? Obviously, at this point only I have the secret stuff needed to access it.

Hence, we need to create a new set of secret stuff or use existing ones and store them in GitHub as secrets.

The secret stuff in this case are

SSH Host (IP of the VPS)
SSH Keys
SSH Port
SSH Username

Generating New SSH Keys

So let's now create a new SSH key

Generate a deployment key locally

ssh-keygen -t ed25519 -C "github-actions-deploy"

Enter the file path

/Users/syedfazil/.ssh/github_actions_deploy

The command creates two files:

github_actions_deploy
github_actions_deploy.pub

github_actions_deploy is the private key. Store its contents in the SSH_PRIVATE_KEY GitHub Secret.
github_actions_deploy.pub is the public key. Add it to the VPS's authorized_keys file.

Copy the public key

cat /Users/syedfazil/.ssh/github_actions_deploy.pub | pbcopy

Add the public key to the VPS authorised SSH keys

vi ~/.ssh/authorized_keys

Add the copied SSH key at the end of the file

Storing the secrets in GitHub

We go to settings again

Scroll down, click on the “Secrets and variables” drop-down, and then on the “Actions” button.

Click on “New repository secret”

Finally, set the variable. And click on “Add secret”.

We need to repeat this process for all four of these variables.

GitHub Action Workflow

Now we are at the conclusion of our work so far

We will set up a GitHub action with this directory structure

.github/workflows/publish.yaml

Inside this file, let's throw the following code.

name: SSH into VPS and deploy

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy over SSH

    steps:
      - name: Deploy project over SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT }}
          script: |
            mkdir -p opensource-usefull

            if [ ! -d opensource-usefull/rssskull/.git ]; then
              git clone https://github.com/fazil-syed/rssskull.git opensource-usefull/rssskull
            fi

            cd opensource-usefull/rssskull
            git pull --rebase -Xours

            docker compose up -d --build

Now, on our next commit, this job will fire and deploy our latest changes

Let's go line by line

name: SSH into VPS and deploy

This defines the name of the action. Pretty self-explanatory.

on:
  push:
    branches:
      - main

This determines the branch that will trigger the action. In this case, main.

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy over SSH

This does several things:

Determines the one job that we are using.
It runs on Ubuntu.
And the name of the job.

Now let's understand the complicated part

steps:
  - name: Deploy project over SSH
    uses: appleboy/ssh-action@v1
    with:
      host: ${{ secrets.SSH_HOST }}
      username: ${{ secrets.SSH_USERNAME }}
      key: ${{ secrets.SSH_PRIVATE_KEY }}
      port: ${{ secrets.SSH_PORT }}
      script: |
        mkdir -p opensource-usefull

        if [ ! -d opensource-usefull/rssskull/.git ]; then
          git clone https://github.com/fazil-syed/rssskull.git opensource-usefull/rssskull
        fi

        cd opensource-usefull/rssskull
        git pull --rebase -Xours

        docker compose up -d --build

This step defines a script that deploys our project to our VPS via SSH.

name: Deploy project over SSH

This sets the name of the step.

uses: appleboy/ssh-action@v1

This allows us to use SSH very easily using third-party actions.

host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USERNAME }}
key: ${{ secrets.SSH_PRIVATE_KEY }}
port: ${{ secrets.SSH_PORT }}

This gives ssh-action access to the environment variables we set on GitHub. With these variables, we will be able to deploy to the VPS.

The Script

This is a simple script made in bash.

script: |
  mkdir -p opensource-usefull

  if [ ! -d opensource-usefull/rssskull/.git ]; then
    git clone https://github.com/fazil-syed/rssskull.git opensource-usefull/rssskull
  fi

  cd opensource-usefull/rssskull
  git pull --rebase -Xours

  docker compose up -d --build

The script: section lets us execute a script.

Let's go over the logic of the script

mkdir -p opensource-usefull

This creates the parent directory if it doesn't exist

if [ ! -d opensource-usefull/rssskull/.git ]; then

Check if my project's directory exists on the VPS

git clone https://github.com/fazil-syed/rssskull.git opensource-usefull/rssskull

If not, then clone the project into the VPS

cd opensource-usefull/rssskull

We enter the directory

git pull --rebase -Xours

I do a rebase, discarding all local changes (changes in the VPS) in favour of the remote changes (changes in GitHub).

docker compose up -d --build

Finally, we are using docker compose to build and run the project

Let's see it in action

What I learned

How to set up a very simple continuous deployment pipeline with GitHub Actions, a VPS and SSH
Taking screenshots in the browser, adding little highlight boxes and pasting them into markdown is very annoying.

Let’s break down DNS: how your browser finds a website

Syed Fazil — Fri, 09 Jan 2026 17:11:42 +0000

To anyone reading this and finds it stupid or annoying, this is my first attempt.

This post is meant for beginners who enjoy a poor guy’s attempt at demystifying the web.

What is DNS?

DNS (Domain Name System) - In simple terms, it's basically a group of computers pointing fingers, and it's also a phonebook for the internet

Why should I care?

Well, if it goes down or if you are unable to access it, you can't doomscroll on Instagram, and also not reach this awesome place to read about DNS.

Why is it needed?

Without DNS, you would have to write 172.217.70.138 every time you wanted to Google Cat images.

172.217.70.138 is the IP address of google.com

Terminology (In My Own Words)

For anyone who, like me, gets the jargon all mixed up, here's a quick intro/refresher

DNS: Domain Name System (The phonebook)
DNS Resolver: A little thingy on your device that asks,

"Hey, what’s the IP address for this domain?"
DNS Server: A server within the DNS that stores the DNS records (A page that includes the mapping of your name (domain) to your address (IP))
DNS Zone: A special place in the DNS world that you manage (your domain and its subdomains)
Domain: The name in the phonebook (your favorite website)
Registrant: This is you when you want to buy a domain
Registrar: This is the business selling you the domain
Register: The organization that maintains the official record that proves you own the domain

The Curiosity

So why am I writing this post?

Actually, this is because I went down a rabbit hole a few days back, and it all began when I thought of buying a domain for myself, and having never done it before, I was curious

I didn't look for who would sell me the domain; instead, I went to a trusted source (ChatGPT) and asked what do I do to buy a domain?

The answer was quite simple:

Go to a registrar
Buy a domain
Point it to a server where your content lives

But that almost seems like magic, so let's break the spell

Breaking DNS into Zones

DNS works in layers (or zones), starting from the top and working its way down to you.

The Root Zone (`.`)

It all begins here.

This . (dot) is the root zone where everyone must cross to reach their destination

But what does it do?

The root zone doesn’t know where every website lives.

Instead, it knows where Top-Level Domains live. Examples:

.com
.org
.dev

Top-Level Domains (TLDs)

The .com or .dev and such domains are called the Top-Level Domains

They are managed (not in an evil way, hopefully) by billion-dollar companies like Verisign and Google.

Their job is simple

Point to the authoritative servers for the domains under them.

So where does this end?

It ends with you, I mean your DNS zone.

Here's a quick example with my very own domain: syedfazil.dev

Here's roughly how things go:

I go to syedfazil.dev on my device
My device asks its DNS resolver

"What's the IP address of syedfazil.dev?"

The resolver asks a root server:

"Where can I find .dev?"
Considering that .dev is managed by Google, the root server responds:

".dev is handled by Google’s TLD servers."
Now we know where .dev is, so let's ask Google:

"Where is syedfazil.dev?"
Google responds with the nameservers of the registrar that sold the domain to me (in my case, from Porkbun).
Finally, the resolver asks those nameservers for the actual records.

Now, as of writing this blog post, I don't have any IP directly mapped to syedfazil.dev, but porkbun, for the time being, has set its own default page.

But I do have another subdomain mapped to hashnode that is blog.syedfazil.dev

So you might ask, where does it know the address of `blog.syedfazil.dev` from?

The answer is that we have already reached the end.

My DNS zone ends at syedfazil.dev

So any subdomains (blog, api, www, etc.) that I have will be present here, and voila, you have successfully learnt how domain name resolution works.

A bit of technical stuff for the nerdy folks

There are 13 logical root servers (named A to M) that use anycasting to distribute the load over thousands of servers all over the world
anycast, meaning:
- Each “server” is actually many servers
- Spread all over the world
This robust network has survived multiple DDoS attempts

So if you have made it this far, then there's more for you

Can someone else take over my domain?

In theory: Yes
In practice: Most likely not

Here's why

The Internet is a mix of both centralized and decentralized systems

While the TLDs and root servers are managed by a few companies and universities
Your zone can be managed by anyone, including yourself!

But let's say you aren't going to host your server for DNS and give that job to someone who already does it, for example, let's take Google DNS

Here's what you would do

You would go over to your Google Cloud Console account
Create a DNS zone
Get the nameservers from Google, then
Go over to your registrar and tell them that you want to use the Google nameservers for your zone.

Where's the risk?

Anyone can create a DNS zone in Google DNS

If you were to

Go to Google and create a DNS zone for syedfazil.dev before me and point it to your IP, and
I was dumb enough to delegate it to my zone to Google before I created the zone

Then you would have taken over my domain (temporarily)

But what if you create the DNS zone later?

Well, you can't because there can only be one zone per domain in a nameserver.

So if you really wanted to use Google DNS, then you can ask the good folks at Google to remove the impostor zone by proving ownership of your domain

Why doesn't this happen frequently?

Because what are the chances that someone will create a DNS zone for your domain before you? And even if they did, you can switch the nameserver to someone else, like from Google to Cloudflare

The End

If you have read till the end, then thank you, and I really appreciate your time, and if there's anything that I have gotten wrong, then please feel free to correct me, and if you have any thoughts or questions, please comment