#!/bin/sh
# sshd's source for the `{{ git_user }}` user's authorized_keys.
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
#
# Gitea maintains that file from inside its container, where it runs as
# {{ podman_user }} (container uid {{ gitea_uid }} is mapped onto that user by
# keep-id), so the file belongs to {{ podman_user }} and not to `{{ git_user }}`.
# sshd refuses a file the login user does not own — that is StrictModes — and
# StrictModes cannot be relaxed for one user, because sshd_config(5) does not
# allow the option inside a Match block. So the file is fed to sshd through
# AuthorizedKeysCommand instead: sshd uses whatever this prints, and applies no
# ownership check to it.
#
# Only lines that force the passthrough shim are printed. Gitea's file also
# carries an unforced entry for the "Gitea Host Key" that the Docker-era
# deployment needed so that its shim could ssh into a second sshd inside the
# container. Nothing reads that entry any more, and printing it would hand an
# interactive `{{ git_user }}` login on this host — and therefore rootless
# Podman, through the sudoers drop-in — to anyone holding a copy of that key,
# a backup included.
#
# The pattern is exactly the shape Gitea writes. If it ever changes,
# git-over-SSH stops working while HTTPS keeps serving, and
#   podman exec {{ container_name }} cat /data/git/.ssh/authorized_keys
# shows what Gitea writes now.
keys="{{ host_directory }}/git/.ssh/authorized_keys"
[ -r "$keys" ] || exit 0
grep -E '^command="{{ shim_path }} ' "$keys"
exit 0