From f4732a0c295a454119d3c2ac01c96f4cc2fa6ab4 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Sun, 26 Jul 2026 03:14:28 +0200 Subject: Move git SSH auth out of /srv/git, harden container sshd Restore (restic --delete) was wiping git's authorized_keys because it lived under the same tree as the backed-up repos, and the backup user couldn't even read it in the first place (0700, permission denied). authorized_keys now lives at /etc/ssh/authorized_keys/git, decoupled from backup/restore entirely. Also add AllowUsers allowlists (pve-lxc-ssh baseline + cgit override) and a Match block restricting the git user to key auth only, no TCP/ agent forwarding or TTY. Co-Authored-By: Claude.ai --- roles/cgit/handlers/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'roles/cgit/handlers/main.yml') diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml index 516733f7..259ae0ea 100644 --- a/roles/cgit/handlers/main.yml +++ b/roles/cgit/handlers/main.yml @@ -4,3 +4,9 @@ ansible.builtin.service: name: lighttpd state: restarted + +- name: "Restart sshd" + become: true + ansible.builtin.service: + name: sshd + state: restarted -- cgit v1.2.3