I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
What I have
In order to deploy the finished site from the CI server to the webserver, I'm connecting via SSH like this:
rsync -rSlh --stats build/ email@example.com:/www/htdocs/blah/tar ssh -o StrictHostKeyChecking=yes firstname.lastname@example.org 'bash -s' -- < deploy.sh /www/htdocs/blah/
(code copied & pasted from multiple blog posts and tutorials)
Authentication is done via a SSH public/private key pair.
Apparently even though I'm authenticating with SSH keys, the user name is still needed (both lines of code above contain
Given that the code above will eventually end up in a public repository on Bitbucket (because that's where the source code of my blog is):
Security-wise, would publishing my SSH username be a problem?
I'm not sure whether I should treat it like a secret or not.
On one hand, the actual authentication is done via SSH keys, so the username is "not that important". On the other hand, now everyone knows my username and could try to brute-force my password.