updaze

.project-wiki/technical/security.md

@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Security
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - security
@@ -19,6 +19,7 @@ source_paths:
 - roles/monitoring/tasks/configure-psk.yml
 - roles/bootstrap/defaults/main.yml
 - ansible.cfg
+- execute.sh
 confidence: confirmed
 ---
 
@@ -39,6 +40,9 @@ confidence: confirmed
 
 ## SSH Posture
 
+- Runtime key access: `execute.sh` bind-mounts the caller's `$HOME/.ssh`
+  (or `SSH_KEY_DIR`) read-only at `/root/.ssh`. It does not rewrite the host
+  SSH configuration or permissions. Private keys are not baked into the image.
 - Controller/transport: `host_key_checking = False`,
   `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
   execute.sh, Dockerfile). Deliberate for first-time provisioning; README