# SSH Access

Keep this access method disabled until the operator approves the host, account, key, and remote path.

## Required variables

- `WP_SSH_HOST`: The approved SSH host.
- `WP_SSH_PORT`: The approved SSH port.
- `WP_SSH_USER`: The name of the restricted SSH account.
- `WP_SSH_KEY_PATH`: The absolute path to the private key outside the repository.
- `WP_SSH_KNOWN_HOSTS_PATH`: The absolute path to the approved `known_hosts` file.
- `WP_REMOTE_PATH`: The approved read-only directory.

Do not store private keys or credentials in the repository.

## Least-privilege account requirements

Use a dedicated SSH account.
Restrict the account to the approved read-only commands.
Give the account read access only to `WP_REMOTE_PATH`.
Do not give the account permission to use `sudo`.
Do not give the account permission to change files, services, or processes.

## Host-key verification

Verify the host-key fingerprint through an approved channel.
Add the approved host key to `WP_SSH_KNOWN_HOSTS_PATH`.
Keep strict host-key verification active.
Do not use options that bypass host-key verification.

## Read-only verification

```bash
scripts/with-environment.sh ssh .env scripts/wp-read.sh core version
```

The `ssh` mode exports only `WP_SSH_*` and `WP_REMOTE_PATH` values.
The wrapper uses `-o ClearAllForwardings=yes`.
The wrapper uses `-o ForwardAgent=no`.
The wrapper uses `-o PermitLocalCommand=no`.

## Prohibited actions

Do not create, change, move, or delete remote files.
Do not change permissions or ownership.
Do not start, stop, or restart services or processes.
Do not use port forwarding or agent forwarding.
Do not permit local commands from SSH configuration.
Do not bypass host-key verification.

## Production write boundary

This repository never authorizes production writes.
Operator approval does not enable writes through this template.
Use a separate access method for an approved production write.
Use a change procedure outside this scaffold for that write.

## Required approval

Get operator approval before you enable SSH access.
The approval must identify the host, account, key, remote path, and host-key fingerprint.