deploy/sshd-forge.conf

# /etc/git-trace/sshd-forge.conf — dedicated sshd instance for the
# forge on port 2222.  Leaves the admin sshd on :22 untouched.
Port 2222
ListenAddress 0.0.0.0
ListenAddress ::
PidFile /run/sshd-git-trace.pid

HostKey /srv/git-trace/var/ssh_host_ed25519_key
HostKey /srv/git-trace/var/ssh_host_rsa_key

# the forge's own user -> identity mapping lives here
AuthorizedKeysFile /srv/git-trace/var/authorized_keys

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers git
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no
PermitTunnel no
GatewayPorts no
StrictModes yes
PrintMotd no
AcceptEnv GIT_TRACE_*

SyslogFacility AUTH
LogLevel VERBOSE