After rsync, chown to caddy:caddy and chmod 755 on the deploy path so the web server can serve the files properly.
GitLab masked variables reject values with whitespace (like SSH keys), so store the key as base64 and decode it in the pipeline.