From f4732a0c295a454119d3c2ac01c96f4cc2fa6ab4 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sun, 26 Jul 2026 03:14:28 +0200
Subject: Move git SSH auth out of /srv/git, harden container sshd

Restore (restic --delete) was wiping git's authorized_keys because it
lived under the same tree as the backed-up repos, and the backup user
couldn't even read it in the first place (0700, permission denied).
authorized_keys now lives at /etc/ssh/authorized_keys/git, decoupled
from backup/restore entirely.

Also add AllowUsers allowlists (pve-lxc-ssh baseline + cgit override)
and a Match block restricting the git user to key auth only, no TCP/
agent forwarding or TTY.

Co-Authored-By: Claude.ai
---
 roles/cgit/handlers/main.yml               |  6 ++++++
 roles/cgit/tasks/main.yml                  | 29 ++++++++++++++++++++++-------
 roles/pve-lxc-ssh/templates/sshd_config.j2 |  2 ++
 3 files changed, 30 insertions(+), 7 deletions(-)

(limited to 'roles')

diff --git a/roles/cgit/handlers/main.yml b/roles/cgit/handlers/main.yml
index 516733f7..259ae0ea 100644
--- a/roles/cgit/handlers/main.yml
+++ b/roles/cgit/handlers/main.yml
@@ -4,3 +4,9 @@
   ansible.builtin.service:
     name: lighttpd
     state: restarted
+
+- name: "Restart sshd"
+  become: true
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
index 7828042a..16a9ab61 100644
--- a/roles/cgit/tasks/main.yml
+++ b/roles/cgit/tasks/main.yml
@@ -32,23 +32,38 @@
     scope: system
     value: main
 
-- name: "Create git user .ssh directory"
+- name: "Ensure sshd_config restricts login to expected users"
   become: true
-  ansible.builtin.file:
-    path: "{{ cgit_repos_dir }}/.ssh"
-    state: directory
-    owner: "{{ cgit_ssh_user }}"
-    group: "{{ cgit_ssh_user }}"
-    mode: "0700"
+  ansible.builtin.lineinfile:
+    path: "/etc/ssh/sshd_config"
+    regexp: "^AllowUsers "
+    line: "AllowUsers root {{ cgit_ssh_user }}"
+    validate: "sshd -T -f %s"
+  notify: "Restart sshd"
 
 - name: "Deploy authorized_keys"
   become: true
   ansible.posix.authorized_key:
     user: "{{ cgit_ssh_user }}"
     key: "{{ item }}"
+    path: "/etc/ssh/authorized_keys/{{ cgit_ssh_user }}"
     state: present
   loop: "{{ user_public_keys }}"
 
+- name: "Configure sshd AuthorizedKeysFile for {{ cgit_ssh_user }}"
+  become: true
+  ansible.builtin.blockinfile:
+    path: "/etc/ssh/sshd_config"
+    marker: "# {mark} ANSIBLE {{ cgit_ssh_user }} MATCH BLOCK"
+    validate: "sshd -T -f %s"
+    block: |
+      Match User {{ cgit_ssh_user }}
+          AuthorizedKeysFile /etc/ssh/authorized_keys/%u
+          AllowTcpForwarding no
+          AllowAgentForwarding no
+          PermitTTY no
+  notify: "Restart sshd"
+
 - name: "Create repos directory"
   become: true
   ansible.builtin.file:
diff --git a/roles/pve-lxc-ssh/templates/sshd_config.j2 b/roles/pve-lxc-ssh/templates/sshd_config.j2
index d8ccc6d2..155eabef 100644
--- a/roles/pve-lxc-ssh/templates/sshd_config.j2
+++ b/roles/pve-lxc-ssh/templates/sshd_config.j2
@@ -7,7 +7,9 @@ KbdInteractiveAuthentication no
 ChallengeResponseAuthentication no
 UsePAM no
 X11Forwarding no
+StreamLocalBindUnlink yes
 PrintMotd yes
+AllowUsers root
 AuthorizedKeysFile .ssh/authorized_keys
 HostKey /etc/ssh/ssh_host_ed25519_key
 Subsystem sftp /usr/lib/ssh/sftp-server
-- 
cgit v1.2.3