Vault/VAULT/ssh_keys_and_agent.md

SSH Keys & Agent

SSH Keypair — per device setup

Problem: No SSH key exists on the device yet. Fix: ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 Key insight: One keypair per device — not per service. Private key never leaves the machine. Public key goes to the server/Forgejo/GitHub.

---

~/.ssh/config — Host entry with Port

Problem: Forgejo runs on a non-standard port (e.g. 2222) — SSH doesn't know that by default. Fix: Host git.bujour.de HostName git.bujour.de User git Port 2222 IdentityFile ~/.ssh/id_ed25519 Key insight: Port gets its own line in the config — not appended to HostName.

---

ssh-agent + ssh-add

Problem: SSH asks for passphrase on every push/pull. Symptom: Could not open a connection to your authentication agent. Diagnosis: Agent isn't running yet. Fix: eval "$(ssh-agent -s)" ssh-add ~/.ssh/id_ed25519 Key insight: ssh-agent must be started first with eval "$(ssh-agent -s)" before ssh-add works. Agent only lives for the current session — needs autostart via .bashrc or .profile (TODO).

---

Forgejo SSH authentication — success message

Problem/Confusion: After ssh -T git@git.bujour.de the response says "Forgejo does not provide shell access" — looks like an error. Key insight: This is the success message. Forgejo (like GitHub) intentionally blocks interactive shell sessions. "Successfully authenticated" in the same message confirms it worked.