---
# git@<host> lands on the host's sshd, which hands the session to the
# Forgejo container. Keys are looked up through the container too
# (AuthorizedKeysCommand), so the host keeps no authorized_keys for git.

- name: Create git user on host
  ansible.builtin.user:
    name: git
    comment: "Forgejo Git User"
    home: "{{ forgejo_base_path }}/data/git"
    create_home: false
    shell: /usr/local/bin/forgejo-shell
    system: true
    groups: docker
    append: true

- name: Deploy forgejo-shell wrapper script
  ansible.builtin.template:
    src: forgejo-shell.j2
    dest: /usr/local/bin/forgejo-shell
    owner: root
    group: root
    mode: "0755"

- name: Deploy SSH daemon configuration for Forgejo passthrough
  ansible.builtin.template:
    src: sshd-forgejo.conf.j2
    dest: /etc/ssh/sshd_config.d/forgejo.conf
    owner: root
    group: root
    mode: "0644"
  notify: Reload SSH daemon