diff --git a/gitea.yml b/gitea.yml
index 02c354c..457e305 100644
--- a/gitea.yml
+++ b/gitea.yml
@@ -2,6 +2,7 @@
   roles:
   - apache
   - gitea
+  - sshd
   tasks:
   - name: ensure apache is running
     service:
diff --git a/group_vars/gitea.yml b/group_vars/gitea.yml
new file mode 100644
index 0000000..54de1a5
--- /dev/null
+++ b/group_vars/gitea.yml
@@ -0,0 +1,8 @@
+sshd_agent_forwarding: false
+sshd_tcp_forwarding: false
+sshd_x11_forwarding: false
+sshd_config_matches:
+- object: User
+  pattern: gitea
+  password_auth: false
+  permit_tty: false