Git and Shared SSH Agent Setup

I did not want every local service user on the VPS to have its own copy of Git credentials.

The cleaner model was:

one host-side Git identity
one shared SSH agent socket
controlled access for other local users through group permissions and wrappers

Why this was better

That approach keeps the private key in one place and shares only the agent socket, not the key material itself.

Operationally, that gives me:

less key sprawl
easier auditing
one predictable SSH configuration path
less chance of per-user Git drift

What the trust boundary really is

The trust boundary is the socket and the permissions around it.

If another local user can talk to the shared agent, that user can ask the agent to authenticate on its behalf. So the real control point is not the key file. It is the directory permissions, the group membership, and the wrapper path that governs how the socket is used.

Why I kept it

For one VPS with multiple local service users, this was a better trade than duplicating credentials everywhere.

It centralizes identity while still letting other local users perform Git operations in a controlled way.