Host server.gib
    HostName server.gib
    User gib
    IdentityFile /home/gib/.ssh/id_ed25519
    IdentitiesOnly yes
    GSSAPIAuthentication no

# Gitea listens on 2222, not 22. Without this, git@git.gbrown.org hits whatever
# answers on port 22 and fails with "Permission denied (publickey)" even though
# the key is registered with Gitea — which is exactly how this looked like a
# broken key rather than a wrong port.
Host git.gbrown.org
    Port 2222
    User git
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

# Agent harnesses (Claude Code, Codex) start their shells without
# SSH_AUTH_SOCK, and id_ed25519 has a passphrase, so batch ssh from them fails
# with "Permission denied (publickey)" even though the key is right. The
# desktop keyring agent already holds the unlocked key; point every host at it.
Host *
    IdentityAgent ${XDG_RUNTIME_DIR}/keyring/ssh
