# git-over-SSH for Gitea's `{{ git_user }}` login user.
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
#
# The authorized_keys file is maintained by Gitea from inside its container, as
# {{ podman_user }}, so `{{ git_user }}` does not own it — which is precisely what
# StrictModes refuses. StrictModes cannot be relaxed for a single user
# (sshd_config(5) does not permit it inside a Match block), so the keys are
# handed to sshd by {{ authorized_keys_command }} instead, which sshd uses
# without any ownership check.
#
# AuthorizedKeysFile=none turns the file lookup off. Without it sshd would still
# read (and log a StrictModes complaint about) ~/.ssh/authorized_keys on every
# connection before falling through to the command.
#
# This drop-in must stay in one file, and the Match block must stay last in it:
# sshd applies everything after a Match to the matched connections only.
Match User {{ git_user }}
    AuthorizedKeysFile none
    AuthorizedKeysCommand {{ authorized_keys_command }}
    AuthorizedKeysCommandUser {{ podman_user }}