The nginx stream proxy forwarding :22 to the knot had no logging, so we had no visibility into who was connecting. Add a stream access log capturing source IP + connection metadata to /var/log/nginx/ssh-proxy.log. SSH is an encrypted tunnel, so git paths/commands inside the session are not visible at this layer -- only connection-level metadata. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>