Problem 1: couldn't use the host defined in my ~/.ssh/config. Had to be explicit path to server including port.
Problem 2: git-receive-pack wasn't in $PATH on my server. This was fixed with:
git config remote.web.receivepack /usr/local/cpanel/3rdparty/bin/git-receive-pack
with origin as the default GitHub remote, and web the host server.
Problem 3: "refusing to update checked out branch". This is fixed by pushing to a bare repo on the server, then creating a post receive hook to check out the branch with your site's root as the work tree, detailed here: http://toroid.org/ams/git-website-howto
I suppose you could create a second branch and switch back and forth, but that seems silly.
So what we end up with is this:
[core]
repositoryformatversion = 0
filemode = true
bare = false
logallrefupdates = true
[remote "origin"]
url = [email protected]:dbb/beratyr.git
fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
remote = origin
merge = refs/heads/master
[remote "web"]
url = ssh://[email protected]:1234/home/user/beratyr.git
fetch = +refs/heads/*:refs/remotes/web/*
receivepack = /usr/local/cpanel/3rdparty/bin/git-receive-pack
And on the server:
% cat hooks/post-receive
#!/bin/sh
GIT_WORK_TREE=/home/user/public_html git checkout -f
All this could be replaced with a simple rsync hook on the local machine, then I would have two hours of my life back.