diff --git a/.gitea/workflows/sync-public.yml b/.gitea/workflows/sync-public.yml
index bfb59e0..6a500a7 100644
--- a/.gitea/workflows/sync-public.yml
+++ b/.gitea/workflows/sync-public.yml
@@ -1,4 +1,37 @@
-      - name: Sync files using .gitea/workflows/openbuild-keep.txt (debug)
+name: Sync public mirror
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    container: node:20-alpine
+
+    steps:
+      - name: Install tools
+        run: apk add --no-cache git rsync openssh-client bash
+
+      - name: Checkout private repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Prepare SSH
+        env:
+          SSH_KEY: ${{ secrets.PUBLIC_REPO_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_sync
+          chmod 600 ~/.ssh/id_sync
+          printf 'Host 192.168.1.15\n  HostName 192.168.1.15\n  Port 22\n  User git\n  IdentityFile ~/.ssh/id_sync\n  IdentitiesOnly yes\n' >> ~/.ssh/config
+          ssh-keyscan -p 22 192.168.1.15 >> ~/.ssh/known_hosts
+
+      - name: Clone public repo
+        run: git clone --depth 1 ssh://git@192.168.1.15:22/Bausager/Flux-openbuild.git /tmp/public
+
+      - name: Sync files using .gitea/workflows/oss-keep.txt (debug)
         run: |
           set -euo pipefail
           set -x