ssh managment

ansible/roles/ssh_hardening/tasks/main.yaml

@@ -101,3 +101,4 @@
       - iptables rules: SSH blocked except from trusted networks
       {% endif %}
       - Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM)
+      - Authorized keys files: .ssh/authorized_keys (manual), .ssh/authorized_keys.forgejo (git-managed)

ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2

@@ -13,6 +13,11 @@ StrictModes yes
 X11Forwarding no
 PrintMotd no
 
+# Multiple authorized_keys files
+# - .ssh/authorized_keys: Manual/emergency keys
+# - .ssh/authorized_keys.forgejo: Git-managed keys (deployed via Forgejo Actions)
+AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.forgejo
+
 # Strong cryptography only
 Ciphers {{ ssh_ciphers | join(',') }}
 MACs {{ ssh_macs | join(',') }}