From ad1a9550963fa954c081698ecb326a14163abd72 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 10 Aug 2026 18:16:15 +0000
Subject: [PATCH] Document ssh-key-import in the README

New section covering what it does, the public-vs-private-key security
model (only public keys are ever fetched, no outbound capability like
private-repo access is granted), and how to run it standalone via
sudo ./setup.sh ssh-key-import. Placed ahead of the existing SSH Host
aliases section since that section already references key import as
prior context ("after SSH key import, the wizard offers to add...").
---
 README.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/README.md b/README.md
index e0086ee..91d33b6 100644
--- a/README.md
+++ b/README.md
@@ -299,6 +299,34 @@ docker compose pull && docker compose up -d   # update
 docker compose down         # stop
 ```
 
+## SSH key import (GitHub/Launchpad) and disabling password login
+
+Imports your public keys from GitHub and/or Launchpad (Canonical/Ubuntu's
+own code-hosting platform) into `~/.ssh/authorized_keys` via
+[`ssh-import-id`](https://manpages.ubuntu.com/manpages/noble/man1/ssh-import-id.1.html),
+so you can log in with a key instead of a password — then optionally locks
+password auth off entirely once at least one key is confirmed imported.
+
+Only your **public** key is ever involved — the same information already
+visible on `github.com/<user>.keys`, fetched over HTTPS. No private key
+material leaves wherever it was generated, and importing a key does **not**
+give this box any ability to authenticate *outward* as you (e.g. it still
+can't clone your private repos) — it only grants *inbound* login to
+whoever holds the matching private key.
+
+Two ways to run it:
+
+- **During `base` install** — runs automatically as part of the required
+  setup on a fresh box, right after the SSH server itself is configured
+- **Any time** — `sudo ./setup.sh ssh-key-import` runs just this step on
+  its own: import more keys later (a new admin, a different box), or set
+  it up on a box that only needs this and nothing else `base` does — e.g.
+  the home box side of [`vpn-data-mount`](#services)
+
+Password authentication is only offered to be disabled if at least one key
+import actually succeeded in that run — never blindly, so you can't get
+locked out by declining every import prompt.
+
 ## SSH Host aliases
 
 `~/.ssh/config` lets you `ssh <alias>` instead of typing `ssh user@1.2.3.4`