Adding proper editor when editing the vault

Adding using Gitea with git over ssh

docs/runbook-configuration.md

@@ -138,6 +138,77 @@ get an account (controlled by `ALLOW_ONLY_EXTERNAL_REGISTRATION`).
 
 Users can now sign in via **Sign in with keycloak** on the Gitea login page.
 
+### 3.3 Use SSH key authentication for Git
+
+Gitea exposes SSH on port **2222** (host port mapped from the container's port 22).
+Clone URLs use the full `ssh://` form because the port is non-standard.
+
+**Generate an SSH key**
+
+If you do not already have a key, generate a dedicated one for Gitea:
+
+```bash
+ssh-keygen -t ed25519 -C "gitea.ladkau.de" -f ~/.ssh/id_ed25519_gitea
+```
+
+Leave the passphrase empty for unattended use, or set one for additional
+security. The command creates two files:
+
+- `~/.ssh/id_ed25519_gitea` — private key (never share this)
+- `~/.ssh/id_ed25519_gitea.pub` — public key (upload this to Gitea)
+
+**Add your key to Gitea**
+
+1. Go to `https://gitea.ladkau.de` → click your avatar (top right) →
+   **Settings** → **SSH / GPG Keys** → **Add Key**.
+2. Paste the contents of `~/.ssh/id_ed25519_gitea.pub`.
+3. Click **Add Key**.
+
+**Test the connection**
+
+```bash
+ssh -p 2222 -i ~/.ssh/id_ed25519_gitea -T git@gitea.ladkau.de
+```
+
+A successful response looks like:
+
+```
+Hi <username>! You've successfully authenticated, but Gitea does not provide shell access.
+```
+
+**Clone, push, and pull**
+
+Gitea shows the correct SSH URL on every repository page. It takes the form:
+
+```
+ssh://git@gitea.ladkau.de:2222/<username>/<repo>.git
+```
+
+```bash
+# Clone
+git clone ssh://git@gitea.ladkau.de:2222/<username>/myrepo.git
+
+# Add remote on an existing repo
+git remote add origin ssh://git@gitea.ladkau.de:2222/<username>/myrepo.git
+```
+
+**Optional: SSH config alias**
+
+Add this to `~/.ssh/config` to avoid repeating the port:
+
+```
+Host gitea.ladkau.de
+    User git
+    Port 2222
+    IdentityFile ~/.ssh/id_ed25519_gitea
+```
+
+With the alias in place you can use the shorter SCP-like URL:
+
+```bash
+git clone git@gitea.ladkau.de:<username>/myrepo.git
+```
+
 ## 4. Nextcloud
 
 The admin credentials are set via `nextcloud_admin_user` and

docs/runbook-provisioning.md

@@ -168,7 +168,7 @@ The script enforces three tiers:
 To edit the vault later:
 
 ```bash
-ansible-vault edit ansible/group_vars/all/vault.yml
+EDITOR=nano ansible-vault edit ansible/group_vars/all/vault.yml
 ```
 
 ### 5. Bootstrap the deploy user