~/.ssh/config: Host Blocks for CI Deploys

A Host block in ~/.ssh/config names a connection and sets its HostName, User, Port, and IdentityFile so you can ssh by alias.

Defining the deploy target once in ssh config keeps every ssh and scp call short and consistent across a pipeline. The file is also where many subtle permission errors come from.

What it does

ssh reads ~/.ssh/config and applies the first matching Host block to a connection. Keys like HostName, User, Port, IdentityFile, and StrictHostKeyChecking become defaults for that alias, so ssh prod expands to the full connection details.

Common usage

Terminal

cat >> ~/.ssh/config <<'EOF'
Host prod
  HostName 203.0.113.10
  User deploy
  Port 2222
  IdentityFile ~/.ssh/deploy_key
  IdentitiesOnly yes
  StrictHostKeyChecking accept-new
EOF
chmod 600 ~/.ssh/config
ssh prod "deploy.sh"

Options

Key	What it does
HostName <addr>	Real hostname or IP to connect to
User <name>	Login user for this alias
Port <n>	Port for this alias
IdentityFile <path>	Private key to use
IdentitiesOnly yes	Offer only that key, not the agent's
ProxyJump <host>	Reach this host through a bastion

In CI

Write the config into the runner's home, then chmod 600 ~/.ssh/config and ensure ~/.ssh is 700. OpenSSH rejects a config file that is group- or world-writable or not owned by the user. Both ssh and scp read this file, so one block covers commands and copies alike.

Common errors in CI

Bad owner or permissions on /root/.ssh/config means the file is too permissive or wrongly owned; chmod 600 it and chown to the runner user. "Bad configuration option" names a typo on the reported line. If a setting seems ignored, an earlier Host block already matched, since the first match wins.