Stack Fit Map
| House surface | Ledger mechanism | Effort |
|---|---|---|
| Authentik SSO (Basecamp, OPS_HUB, mail.relik.africa) | Security Key app — FIDO2/U2F WebAuthn factor | Low, off-the-shelf |
| Forgejo (from-admin) | WebAuthn 2FA + GPG commit/tag signing | Low |
| SSH to relik-pi4 / relik-vps / Forgejo git | OpenPGP app, auth subkey via gpg-agent | Medium, fiddly |
| AGE secrets garden (*.env.age) | age-plugin-fido2-hmac, needs hmac-secret support | Test required |
| Feed/infra mutation authorization | Custom BOLOS app — signed approvals | High, custom build |