Stack Fit Map

House surface Ledger mechanism Effort
Authentik SSO (Basecamp, OPS_HUB, mail.relik.africa) Security Key app — FIDO2/U2F WebAuthn factor Low, off-the-shelf
Forgejo (from-admin) WebAuthn 2FA + GPG commit/tag signing Low
SSH to relik-pi4 / relik-vps / Forgejo git OpenPGP app, auth subkey via gpg-agent Medium, fiddly
AGE secrets garden (*.env.age) age-plugin-fido2-hmac, needs hmac-secret support Test required
Feed/infra mutation authorization Custom BOLOS app — signed approvals High, custom build