really only a temporary solution for now, ideally we would do it so only the forgejo user can use the .ssh/authorizedKeys file in their home folder. but nix purity rules prevents that
