# ~atheos/.ssh/config  —  install to /home/atheos/.ssh/config (mode 600, owner atheos)
#
# gitea-blog: per-repository deploy key for armistace/blog (design decision D6).
#
# !! THE USER IS `gitea`, NOT `git` !!
#   This instance's app.ini sets  SSH_USER = gitea.
#   With `git` the sshd on that host answers "Invalid user git" and rejects the
#   connection BEFORE reading authorized_keys - which looks identical to a
#   rejected key. Verified in the sshd log on LXC 109, 2026-09-29.
#
# Why the LAN address rather than git.aridgwayweb.com:
#   - app.ini sets  SSH_DOMAIN = 192.168.178.155 / SSH_PORT = 22
#     with START_SSH_SERVER = false, i.e. SSH is served by the Gitea LXC's own sshd.
#   - the public path does NOT forward :22 (only :443, via NPM). Verified:
#       git.aridgwayweb.com:22  -> unreachable
#       192.168.178.155:22      -> OPEN
#   - this guest is LAN-only, so LAN transport is correct and avoids an internet round-trip.
#
# IdentitiesOnly yes ensures no other key is ever offered to the server.
Host gitea-blog
    HostName 192.168.178.155
    User gitea
    IdentityFile ~/.ssh/id_ed25519_blog
    IdentitiesOnly yes
    Port 22