Git over SSH

Clone and push to git.rootiest.dev with your SSH key, on the normal SSH port.

1. Add your key to Gitea

Open Settings → SSH / GPG Keys, choose Add Key, and paste your public key (the .pub file). No key yet? Create one:

ssh-keygen -t ed25519 -C "you@example.com"

Then paste the output of cat ~/.ssh/id_ed25519.pub. Hardware keys (ed25519-sk, YubiKey and similar) work too.

2. Check that it works

ssh -T git@git.rootiest.dev

Gitea answers Hi there, <you>! You've successfully authenticated… and closes the connection. That's expected: Gitea gives git access, never a shell.

The first time, SSH asks you to confirm the server. Compare the fingerprint with the table below before typing yes, or set up automatic verification so it never asks.

3. Clone and push

Every repository's SSH address looks like this (no port number needed):

git clone git@git.rootiest.dev:owner/repo.git

The SSH tab of the clone box on each repository page shows the exact address.

Already using port 222?

Older addresses with :222 still work. To switch an existing clone:

git remote set-url origin git@git.rootiest.dev:owner/repo.git

Verify the server automatically (recommended)

git.rootiest.dev has a standby server that takes over if the main one goes down. The two servers have different host keys, so after a switch SSH would warn that the host key changed. Both keys are signed by the Rootiest host certificate authority, so if you trust that instead, SSH checks the signature, never warns on a switch, and never asks you to confirm a fingerprint.

Add these two lines to ~/.ssh/known_hosts (on Windows: %USERPROFILE%\.ssh\known_hosts). The second one is a backup authority.

@cert-authority git.rootiest.dev sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA5/76o253spGXEnaahuqG9e7cDd8ADfQqu09wuYJolhAAAAFHNzaDpyb290aWVzdC1ob3N0LWNh
@cert-authority git.rootiest.dev sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC3wLNF6bHQJkJzX8P0+7krec3QcBzxq98EWwv4gXRfHAAAAFHNzaDpyb290aWVzdC1ob3N0LWNh

Or append them in one go:

curl -fsS https://git.rootiest.fyi/known_hosts >> ~/.ssh/known_hosts

The authorities' fingerprints, if you want to check them:

Host key fingerprints

If you'd rather confirm by hand, these are the ed25519 keys SSH will show:

Troubleshooting

Permission denied (publickey)

The key SSH offered isn't on your Gitea account. Check which keys you're offering with ssh -v -T git@git.rootiest.dev, and that the matching .pub is listed in your SSH keys. To force one key, add this to ~/.ssh/config:

Host git.rootiest.dev
    User git
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

REMOTE HOST IDENTIFICATION HAS CHANGED

Hardware key: nothing happens

Security keys wait for a touch. Look for the blinking light during clone, fetch and push.

Can I log in or forward ports?

No. The git account only runs git operations: no shell, terminal or port forwarding.