# pos-tunnel relay (design 6.2), installed by relay-startup. POS machines (user `tunnel`) are
# untrusted: they may only remote-forward their own port.

Port 2222
HostKey /run/relay/ssh_host_ed25519_key
PidFile /run/sshd.pid
# VERBOSE logs each offered key's fingerprint. `sshd -E` sends the log to the daemon (design 6.5).
LogLevel VERBOSE

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowUsers tunnel jump ctl
AuthorizedKeysFile none

GatewayPorts no
X11Forwarding no
AllowAgentForwarding no
AllowStreamLocalForwarding no
PermitTunnel no
PermitUserRC no
PermitTTY no

ClientAliveInterval 30
ClientAliveCountMax 3

# Keys come from the daemon through tunnel-keys, one restricted line per lease; `%f` is the offered
# key's fingerprint, which tunnel-keys reports with its parent, the connection (design 6.3).
# `remote` (not `yes`) is the isolation control: no -L, so no reaching other POS tunnels.
Match User tunnel
    AuthorizedKeysCommand /app/.venv/bin/tunnel-keys %u %f
    AuthorizedKeysCommandUser keyreader
    AllowTcpForwarding remote
    PermitOpen none
    ForceCommand /usr/sbin/nologin

# Operator ProxyJump into a POS tunnel on loopback.
Match User jump
    AuthorizedKeysFile /etc/ssh/operator_keys
    AllowTcpForwarding local
    PermitOpen localhost:*
    PermitListen none
    ForceCommand /usr/sbin/nologin

# Operator session management (design 6.4); ExposeAuthInfo names the operator to the daemon.
Match User ctl
    AuthorizedKeysFile /etc/ssh/operator_keys
    AllowTcpForwarding no
    ExposeAuthInfo yes
    ForceCommand /app/.venv/bin/tunnelctl
