diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-26 03:14:28 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-26 03:14:28 +0200 |
| commit | f4732a0c295a454119d3c2ac01c96f4cc2fa6ab4 (patch) | |
| tree | 2fdd668776c1c21110c40bf7ff072695006a9eef /roles/font/tasks/install-archlinux.yml | |
| parent | e90c85bcef16b57aa8d4dfec6bfcc7e2c25c0848 (diff) | |
Move git SSH auth out of /srv/git, harden container sshd
Restore (restic --delete) was wiping git's authorized_keys because it
lived under the same tree as the backed-up repos, and the backup user
couldn't even read it in the first place (0700, permission denied).
authorized_keys now lives at /etc/ssh/authorized_keys/git, decoupled
from backup/restore entirely.
Also add AllowUsers allowlists (pve-lxc-ssh baseline + cgit override)
and a Match block restricting the git user to key auth only, no TCP/
agent forwarding or TTY.
Co-Authored-By: Claude.ai
Diffstat (limited to 'roles/font/tasks/install-archlinux.yml')
0 files changed, 0 insertions, 0 deletions