# The LAN recovery door. debian2 and debian3 were lost because every way in was the
# same door: one sshd, one config tree, one converge. This socket shares none of that
# state — it binds the wildcards itself and hands each connection to a fresh sshd
# reading a config outside /etc/ssh.
#
# A socket rather than a long-running daemon: the bind happens in PID 1 before any
# sshd runs, so a broken sshd cannot leave the port unbound, and there is no crash
# loop to give up on. Nothing in the boot ordering requires this unit, so a socket
# that cannot bind degrades to one fewer door and never wedges the boot.
[Unit]
Description=LAN recovery ssh door on 2223, independent of the converged sshd

#
# BindIPv6Only is load-bearing. net.ipv6.bindv6only is 0 on these boxes, so a default
# [::] socket is dual-stack and its bind fails with EADDRINUSE behind the 0.0.0.0 one —
# the socket unit then fails as a whole and the door is not there at all.
[Socket]
ListenStream=0.0.0.0:2223
ListenStream=[::]:2223
BindIPv6Only=ipv6-only
Accept=yes

[Install]
WantedBy=sockets.target