---
id: BB-ISSUE-09B4E3CB
type: issue
title: Infrastructure contract drift
specs:
  - BB-SPEC-613373B7
  - BB-SPEC-9C4F71E1
  - BB-SPEC-579A27BC
---

# Infrastructure contract drift

## Relay SSH hardening

Historical architecture claimed pre-generated host keys and explicit password-authentication disablement.
The root module passes host-key variables, but cloud-init does not install them or encode the claimed password policy.
Choose implementation or a narrower contract before closing.

## Public Git web

Repository configuration routes `vcs.bugabinga.net` to Luigit.
Soft Serve provides Git SSH; Luigit's networkless exporter supplies public repository metadata.
Live route and legacy-service state require runtime verification.

## Recursive formatting

Repository guidance required recursive OpenTofu formatting.
`just check` and lefthook currently invoke non-recursive `tofu fmt`.
Make automation recursive or narrow the rule.