capistrano deployment using CircleCI 2.0

circle.yml

version: 2
jobs:
  build:
    docker:
      - image: ruby:2.3.3-alpine
    working_directory: /home/circleci/masutaka.net
    steps:
      - setup_remote_docker:
          # https://circleci.com/docs/2.0/docker-layer-caching/
          reusable: true
      - run:
          name: Install System Dependencies
          # See also https://circleci.com/docs/2.0/custom-images/#required-tools
          command: apk add --update --no-cache git openssh-client tar gzip build-base tzdata
      - run:
          name: Set timezone to Asia/Tokyo
          command: cp /usr/share/zoneinfo/Asia/Tokyo /etc/localtime
      - checkout
      - restore_cache:
          name: Restore bundler cache
          keys:
            - gems-{{ .Environment.COMMON_CACHE_KEY }}-{{ checksum "Gemfile.lock" }}
            - gems-{{ .Environment.COMMON_CACHE_KEY }}-
      - run:
          name: Install Ruby Dependencies
          command: bundle check || bundle install --jobs=4 --retry=3
      - save_cache:
          name: Save bundler cache
          key: gems-{{ .Environment.COMMON_CACHE_KEY }}-{{ checksum "Gemfile.lock" }}
          paths:
            - /usr/local/bundle
      - add_ssh_keys:
          fingerprints:
            # for ssh to masutaka.net
            # See https://circleci.com/gh/masutaka/masutaka.net/edit#ssh
            - "43:7f:b2:..."
      - deploy:
          name: Maybe Deploy
          command: |
            if [ "${CIRCLE_BRANCH}" != "master" ]; then
              exit 0
            fi

            if [ -z "${BUNDLE_UPDATE}" ]; then
              ./script/deploy-circleci.sh
            else
              gem install -N bundler circleci-bundle-update-pr
              circleci-bundle-update-pr CircleCI [email protected]
            fi

deploy-circleci.sh

#!/bin/sh -eu

cat <<EOF >> $HOME/.ssh/config
  User masutaka
  ForwardAgent yes
EOF

# Add the preferred key for getting GitHub Permission
# See https://circleci.com/gh/masutaka/masutaka.net/edit#checkout
eval $(ssh-agent)
ssh-add

bundle exec cap prod deploy

When I try to adapt this setup to my own project, CircleCI asks for my deploy user's password when it gets to the cap production deploy step. But that doesn't happen when I run that command manually. I'm assuming I have the wrong SSH keys set up in the wrong place? Do you have any insight into this?