try this for deployment

.gitlab-ci.yml

@@ -3,6 +3,7 @@ image: gitlab.cs.wallawalla.edu:5050/elock/controller:latest
 stages:
   - build
   - test
+  - deploy
 
 build_tests:
   stage: build
@@ -23,8 +24,6 @@ build_esp32_application:
     - cp main/include/config.h.example main/include/config.h
     - /opt/esp/entrypoint.sh bash
     - idf.py build
-    - echo "$SIGNING_KEY" | base64 -d -w 0 > decoded.pem
-    - espsecure.py sign_data --keyfile decoded.pem --version 1 build/door-controller.bin
   artifacts:
     paths:
       - build/door-controller.bin
@@ -34,3 +33,25 @@ test_application:
   stage: test
   script:
     - build/door-controller-universal-tests
+
+deploy_controller_update:
+  stage: deploy
+  before_script:
+    - apt-get update -qq
+    - apt-get install -qq rsync
+    - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - ssh-add <(echo "$SSH_PRIVATE_KEY")
+    - mkdir -p ~/.ssh
+    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
+  script:
+    - echo "$SIGNING_KEY" | base64 -d -w 0 > decoded.pem
+    - espsecure.py sign_data --keyfile decoded.pem --version 1 build/door-controller.bin
+    - version=$(<version.txt)
+    - deploy_name="v${version}.bin"
+    # Can't use the CI job token to deploy the artifact because that's a "pRemiUm FEATurE"
+    - "rsync build/door-controller.bin $SSH_USER@$SSH_HOST:/home/$SSH_USER/doorcode/src/backend/storage/app/controller/binaries/$deploy_name"
+  when: manual
+  only:
+    - deploy
+