# git over ssh to git.soarez.net with the YubiKey git keys: git clone
# git@git.soarez.net:sz/<name>.git, one touch of a key per fetch or push.
#
# Read only on a host that opted in: `yubikey-git enable` links this file into
# ~/.config/ssh/enabled.d/, which config/ssh/entry includes. See bin/yubikey-git.
#
# The keys are the id_ed25519_sk_git* files beside this file, one FIDO2 key per
# YubiKey, whose private half never leaves it. Each file is only a handle:
# useless without its YubiKey, and the YubiKey signs nothing without a touch.
# git.soarez.net accepts them for git on the repositories and nothing else. Any
# one will do: ssh passes over those whose YubiKey is not plugged in. After
# adding one here, re-run `yubikey-git enable` on each host that opted in.

Host git.soarez.net
  User git
  IdentityFile ~/.ssh/id_ed25519_sk_git_main_nfc
  IdentityFile ~/.ssh/id_ed25519_sk_git_backup_nfc
  IdentityFile ~/.ssh/id_ed25519_sk_git
  IdentitiesOnly yes
  # Pinned, not learned: on a machine we do not trust, the first connection is
  # exactly the one an attacker would intercept.
  HostKeyAlias git.soarez.net
  StrictHostKeyChecking yes
  UserKnownHostsFile ~/.config/ssh/yubikey-git/known_hosts
  # Never share a connection: a master left open would let anything on this
  # machine fetch or push without a touch.
  ControlMaster no
  ControlPath none
  ForwardAgent no
