diff --git a/.woodpecker/db.yml b/.woodpecker/db.yml
index 95148aa..99f7adf 100644
--- a/.woodpecker/db.yml
+++ b/.woodpecker/db.yml
@@ -32,27 +32,61 @@ steps:
     image: alpine:latest
     depends_on: [ secrets ]
     commands:
-      - set -euo pipefail
-      - apk add --no-cache bash openssh-client rsync coreutils
-      - set -a
-      - . ./ci/prod/.env.runtime
-      - . ./.env.version
-      - set +a
-      - ': "${REMOTE_BASE:?missing REMOTE_BASE}"'
-      - ': "${DB_DIR:?missing DB_DIR}"'
-      - ': "${SSH_USER:?missing SSH_USER}"'
-      - ': "${SSH_HOST:?missing SSH_HOST}"'
-      - SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
-      - REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
-      - REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
-      - ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
-      - rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-      - rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
       - |
+        set -Eeuo pipefail
+
+        apk add --no-cache bash openssh-client rsync coreutils
+
+        mkdir -p /root/.ssh
+        # проверим, что секретный ключ реально есть
+        [ -s secrets/SSH_KEY ] || { echo "ERROR: secrets/SSH_KEY missing"; ls -laR; exit 1; }
+        install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
+
+        # sanity: файл с переменными существует и без CRLF
+        [ -f ./ci/prod/.env.runtime ] || { echo "ERROR: ./ci/prod/.env.runtime not found"; exit 1; }
+        sed -i 's/\r$//' ./ci/prod/.env.runtime
+        echo '--- .env.runtime (snippet) ---'
+        grep -nE '^(REMOTE_BASE|DB_DIR|SSH_USER|SSH_HOST)=' ./ci/prod/.env.runtime || true
+
+        # загрузка env-файлов
+        set -a
+        . ./ci/prod/.env.runtime
+        . ./.env.version
+        set +a
+
+        # жёсткие ассерты — если хоть что-то пустое, ОСТАНАВЛИВАЕМСЯ
+        : "${REMOTE_BASE:?missing REMOTE_BASE}"
+        : "${DB_DIR:?missing DB_DIR}"
+        : "${SSH_USER:?missing SSH_USER}"
+        : "${SSH_HOST:?missing SSH_HOST}"
+
+        printf 'REMOTE_BASE=%s\nDB_DIR=%s\nSSH_USER=%s\nSSH_HOST=%s\n' \
+          "$REMOTE_BASE" "$DB_DIR" "$SSH_USER" "$SSH_HOST"
+
+        SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
+        REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
+        REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+
+        # быстрая проверка, что ключ читается
+        ssh $SSH_OPTS -o BatchMode=yes "$REMOTE_TARGET" 'echo "[whoami] $(whoami) @ $(hostname) $(date -Is)"'
+
+        # синк
+        ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+        rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+        rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+
+        # деплой на удалёнке (ВАЖНО: bash -s, чтобы heredoc выполнился)
         ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" bash -s <<'EOSSH'
         set -Eeuxo pipefail
+        echo "[remote] whoami=$(whoami) host=$(hostname) pwd=$PWD"
         cd "${REMOTE_DIR}/compose"
-        ...
+        set -a; . ../env/.env.runtime; set +a
+        docker compose -f db.yml pull
+        docker compose -f db.yml up -d --remove-orphans
+        docker compose ps
+        date -Is | tee .last_deploy
+        logger -t deploy-db "db deployed at $(date -Is) in ${REMOTE_DIR}"
         EOSSH
 
 
+