Move git SSH auth out of /srv/git, harden container sshd

Restore (restic --delete) was wiping git's authorized_keys because it
lived under the same tree as the backed-up repos, and the backup user
couldn't even read it in the first place (0700, permission denied).
authorized_keys now lives at /etc/ssh/authorized_keys/git, decoupled
from backup/restore entirely.

Also add AllowUsers allowlists (pve-lxc-ssh baseline + cgit override)
and a Match block restricting the git user to key auth only, no TCP/
agent forwarding or TTY.

Co-Authored-By: Claude.ai

3 files changed, 30 insertions, 7 deletions

diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml
index 516733f7..259ae0ea 100644
--- a/roles/cgit/handlers/main.yml
+++ b/roles/cgit/handlers/main.yml
@@ -4,3 +4,9 @@
   ansible.builtin.service:
     name: lighttpd
     state: restarted
+
+- name: "Restart sshd"
+  become: true
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
index 7828042a..16a9ab61 100644
--- a/roles/cgit/tasks/main.yml
+++ b/roles/cgit/tasks/main.yml
@@ -32,23 +32,38 @@
     scope: system
     value: main
 
-- name: "Create git user .ssh directory"
+- name: "Ensure sshd_config restricts login to expected users"
   become: true
-  ansible.builtin.file:
-    path: "{{ cgit_repos_dir }}/.ssh"
-    state: directory
-    owner: "{{ cgit_ssh_user }}"
-    group: "{{ cgit_ssh_user }}"
-    mode: "0700"
+  ansible.builtin.lineinfile:
+    path: "/etc/ssh/sshd_config"
+    regexp: "^AllowUsers "
+    line: "AllowUsers root {{ cgit_ssh_user }}"
+    validate: "sshd -T -f %s"
+  notify: "Restart sshd"
 
 - name: "Deploy authorized_keys"
   become: true
   ansible.posix.authorized_key:
     user: "{{ cgit_ssh_user }}"
     key: "{{ item }}"
+    path: "/etc/ssh/authorized_keys/{{ cgit_ssh_user }}"
     state: present
   loop: "{{ user_public_keys }}"
 
+- name: "Configure sshd AuthorizedKeysFile for {{ cgit_ssh_user }}"
+  become: true
+  ansible.builtin.blockinfile:
+    path: "/etc/ssh/sshd_config"
+    marker: "# {mark} ANSIBLE {{ cgit_ssh_user }} MATCH BLOCK"
+    validate: "sshd -T -f %s"
+    block: |
+      Match User {{ cgit_ssh_user }}
+          AuthorizedKeysFile /etc/ssh/authorized_keys/%u
+          AllowTcpForwarding no
+          AllowAgentForwarding no
+          PermitTTY no
+  notify: "Restart sshd"
+
 - name: "Create repos directory"
   become: true
   ansible.builtin.file:
diff --git a/roles/pve-lxc-ssh/templates/sshd_config.j2 b/roles/pve-lxc-ssh/templates/sshd_config.j2
index d8ccc6d2..155eabef 100644
--- a/roles/pve-lxc-ssh/templates/sshd_config.j2
+++ b/roles/pve-lxc-ssh/templates/sshd_config.j2
@@ -7,7 +7,9 @@ KbdInteractiveAuthentication no
 ChallengeResponseAuthentication no
 UsePAM no
 X11Forwarding no
+StreamLocalBindUnlink yes
 PrintMotd yes
+AllowUsers root
 AuthorizedKeysFile .ssh/authorized_keys
 HostKey /etc/ssh/ssh_host_ed25519_key
 Subsystem sftp /usr/lib/ssh/sftp-server