Security
The server has no open SSH port, and only Cloudflare can reach it. Traffic is encrypted all the way to the server.
Each deploy uses short-lived AWS credentials that GitHub requests for that run. Secrets live in AWS Secrets Manager, never in the code.