# One instance per accepted connection on buildbox-rescue-sshd.socket.
#
# sshd chroots to the compiled-in privilege separation directory /run/sshd for every
# connection, and ssh.service owns that path through RuntimeDirectory=sshd — systemd
# deletes it when ssh.service stops, which is exactly the state this door serves.
# ExecStartPre recreates it per connection; RuntimeDirectory= is deliberately NOT
# declared here, so systemd never removes the directory the primary sshd also needs.
[Unit]
Description=LAN recovery ssh session on 2223

[Service]
ExecStartPre=/usr/bin/install -d -m 0755 -o root -g root /run/sshd
ExecStart=-/usr/sbin/sshd -i -e -f /etc/buildbox-rescue-door/sshd_config
StandardInput=socket
StandardError=journal
# Same protections as the converged sshd: this door is worthless if reclaim or the OOM
# killer takes it while agents saturate the box.
MemoryMin=16M
CPUWeight=10000
IOWeight=10000
OOMScoreAdjust=-900