Historical architecture claimed pre-generated host keys and explicit password-authentication disablement.
The root module passes host-key variables, but cloud-init does not install them or encode the claimed password policy.
Choose implementation or a narrower contract before closing.
Public Git web
Repository configuration routes vcs.bugabinga.net to Luigit.
Soft Serve provides Git SSH; Luigit's networkless exporter supplies public repository metadata.
Live route and legacy-service state require runtime verification.
Recursive formatting
Repository guidance required recursive OpenTofu formatting.
just check and lefthook currently invoke non-recursive tofu fmt.
Make automation recursive or narrow the rule.
---
id: BB-ISSUE-09B4E3CB
type: issue
title: Infrastructure contract drift
specs:
- BB-SPEC-613373B7
- BB-SPEC-9C4F71E1
- BB-SPEC-579A27BC
---
# Infrastructure contract drift
## Relay SSH hardening
Historical architecture claimed pre-generated host keys and explicit password-authentication disablement.
The root module passes host-key variables, but cloud-init does not install them or encode the claimed password policy.
Choose implementation or a narrower contract before closing.
## Public Git web
Repository configuration routes `vcs.bugabinga.net` to Luigit.
Soft Serve provides Git SSH; Luigit's networkless exporter supplies public repository metadata.
Live route and legacy-service state require runtime verification.
## Recursive formatting
Repository guidance required recursive OpenTofu formatting.
`just check` and lefthook currently invoke non-recursive `tofu fmt`.
Make automation recursive or narrow the rule.