# Dedicated listener; do not replace the host's operator SSH configuration.
Port 2222
ListenAddress 0.0.0.0
HostKey /var/lib/gitsvc/ssh-host-keys/ssh_host_ed25519_key
PidFile /run/gitsvc-ssh/sshd.pid
AllowUsers git
AuthenticationMethods publickey
PubkeyAuthentication yes
PubkeyAcceptedAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
RequiredRSASize 3072
AuthorizedKeysFile none
AuthorizedKeysCommand /usr/local/bin/gitsvc authorized-key %t %k
AuthorizedKeysCommandUser gitlookup
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitEmptyPasswords no
PermitRootLogin no
UsePAM no
PermitTTY no
AllowAgentForwarding no
AllowTcpForwarding no
AllowStreamLocalForwarding no
X11Forwarding no
PermitTunnel no
PermitUserRC no
PermitUserEnvironment no
# The dispatcher admits only the exact value version=2. No other GIT_* is accepted.
AcceptEnv GIT_PROTOCOL
MaxAuthTries 3
MaxSessions 4
MaxStartups 10:30:30
LoginGraceTime 30
ClientAliveInterval 30
ClientAliveCountMax 2
LogLevel VERBOSE
# No global ForceCommand: per-key identity must reach the restricted login shell.
# Configure the git account's shell as /usr/local/libexec/gitsvc-login, a root-owned
# symlink to /usr/local/bin/gitsvc. That entry point reads /etc/gitsvc/config.toml.
