# Let Gitea's `{{ git_user }}` login user run exactly one command as
# {{ podman_user }}: the wrapper that execs into Gitea's rootless container.
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
#
# This is what replaces the ssh hop the Docker-era deployment used. A rootless
# container belongs to one user and cannot be entered by another, and no sshd
# runs inside the container any more, so the forced command sshd runs for a git
# client has to become `podman exec` — run as {{ podman_user }}.
#
# No arguments are pinned, on purpose. The command line comes from the
# authorized_keys lines Gitea maintains (… serv key-N), and that file is already
# the thing deciding who may reach which repository; restating its format here
# would only add a second place to update whenever Gitea changes it, and pinning
# it loosely enough to be useful (… serv *) would not restrict anything the
# wrapper does not already fix — container, uid and environment are all baked
# into {{ podman_exec_wrapper }}.
{{ git_user }} ALL=({{ podman_user }}) NOPASSWD: {{ podman_exec_wrapper }}