# SSH Hardening Configuration
# Generated by Ansible on {{ ansible_date_time.iso8601 }}
# Server: {{ inventory_hostname }}

# Connection settings
MaxAuthTries {{ ssh_max_auth_tries }}
MaxSessions {{ ssh_max_sessions }}
ClientAliveInterval {{ ssh_client_alive_interval }}
ClientAliveCountMax {{ ssh_client_alive_count_max }}

# Security hardening
StrictModes yes
X11Forwarding no
PrintMotd no

# Multiple authorized_keys files
# - .ssh/authorized_keys: Manual/emergency keys
# - .ssh/authorized_keys.forgejo: Git-managed keys (deployed via Forgejo Actions)
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.forgejo

# Strong cryptography only
Ciphers {{ ssh_ciphers | join(',') }}
MACs {{ ssh_macs | join(',') }}
KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}

# Access control - restrict shell users to trusted networks only
{% if ssh_shell_users | length > 0 and ssh_allowed_networks | length > 0 %}
AllowUsers {% for user in ssh_shell_users %}{% for network in ssh_allowed_networks %}{{ user }}@{{ network }} {% endfor %}{% endfor %}{% if ssh_allow_public_git %}{{ ssh_git_user }}{% endif %}

{% elif ssh_allow_public_git %}
# Allow Forgejo git user from anywhere for git operations
AllowUsers {{ ssh_git_user }}
{% endif %}