| hcloud_token | Hetzner API token (store as secret) | yes | — |
| server_name | Logical server name to find or create | yes | — |
| project_tag | Tag used to identify servers shared across repos | yes | — |
| image | Hetzner image slug (default: ubuntu-24.04) | no | ubuntu-24.04 |
| server_type | Hetzner server type (default: cx23) | no | cx23 |
| ipv6_only | If true, provision with IPv6 only (no public IPv4). Warning: GitHub-hosted runners do not provide outbound IPv6 connectivity, so this action's deploy stages and any later steps that connect to an IPv6-only server require a self-hosted runner with IPv6 support. | no | false |
| duckdns | DuckDNS configuration in combined token:domain format | no | — |
| public_key | SSH public key to register on the server | yes | — |
| ssh_private_key | SSH private key for rsync (store as secret) | yes | — |
| ssh_user | SSH user for connecting to the server | no | root |
| service_name | Systemd service name to restart after deploy | no | — |
| service | Structured systemd service YAML mapping. Configures the generated unit file. When the 'user' key is set, the pipeline provisions the system account and chowns the working directory (or target_dir). Overrides legacy flat service_* and exec_start inputs for matching settings. | no | "" |
| service_type | Systemd service Type= value (default: simple). Overridden when the structured service YAML input includes type. | no | simple |
| service_restart | Systemd service Restart= value (default: on-failure). Overridden when the structured service YAML input includes restart. | no | on-failure |
| service_restart_sec | Systemd service RestartSec= value in seconds (default: 5). Overridden when the structured service YAML input includes restart-sec. | no | 5 |
| exec_start | Custom systemd ExecStart= command to use for the service. When omitted, a placeholder command is used and a warning is emitted. | no | — |
| source_dir | Directory in the workspace to deploy | no | . |
| target_dir | Target directory on the VPS where files will be placed | no | /opt/app |
| container_image | Container image reference — enables the podman stage when set | no | — |
| container_port | Container port mapping for Podman, e.g. 8080 or 8080:80 | no | 8080 |
| haproxy_cfg | Path to HAProxy config — enables the haproxy stage when set | no | — |
| host_port | Host port for HAProxy routing (default: 443) | no | 443 |
| route | Route pattern for HAProxy routing (default: /*) | no | /* |
| app_port | Application port for HAProxy routing | no | — |
| certbot | String boolean to enable certbot ACME support | no | false |
| certbot_port | String port for certbot ACME challenge handling | no | 8888 |
| firewall_enabled | If true, enable the firewall stage | no | true |
| haproxy_fragment | Path to an HAProxy config fragment to append when haproxy_cfg is set | no | — |
| haproxy_fragment_name | Optional name used for the HAProxy fragment file on the server | no | fragment |
| firewall_extra_ports | Comma-separated extra firewall ports to allow, e.g. 8080, 8443 | no | "" |