# Managed by Ansible — do not edit manually
Port 22
Protocol 2

# Authentication
PermitRootLogin prohibit-password
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# Only allow the deploy user and root over SSH
AllowUsers {{ deploy_user }} root

# Misc hardening
X11Forwarding no
PrintMotd no
MaxAuthTries 3
LoginGraceTime 30

UsePAM yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
