diff --git a/.gitea/workflows/diagnose-ssh.yml b/.gitea/workflows/diagnose-ssh.yml
new file mode 100644
index 0000000..c0fa637
--- /dev/null
+++ b/.gitea/workflows/diagnose-ssh.yml
@@ -0,0 +1,55 @@
+name: Diagnose SSH
+
+on:
+  workflow_dispatch:
+
+jobs:
+  diagnose:
+    name: Diagnostico SSH no servidor
+    runs-on: omnichannel-uat
+
+    steps:
+      - name: Status do sshd
+        shell: bash
+        run: |
+          echo "=== systemctl status sshd ==="
+          sudo systemctl status sshd --no-pager || true
+
+      - name: Logs recentes do sshd
+        shell: bash
+        run: |
+          echo "=== journalctl sshd (ultimas 50 linhas) ==="
+          sudo journalctl -u sshd -n 50 --no-pager || true
+
+      - name: Fail2ban status
+        shell: bash
+        run: |
+          echo "=== fail2ban-client status ==="
+          sudo fail2ban-client status 2>/dev/null || echo "fail2ban nao instalado ou sem permissao"
+          echo ""
+          echo "=== fail2ban jail sshd ==="
+          sudo fail2ban-client status sshd 2>/dev/null || echo "jail sshd nao encontrado"
+
+      - name: IPs banidos no fail2ban
+        shell: bash
+        run: |
+          echo "=== IPs banidos (iptables) ==="
+          sudo iptables -L f2b-sshd -n 2>/dev/null || sudo iptables -L -n 2>/dev/null | grep -A5 "f2b" || echo "Sem regras f2b encontradas"
+
+      - name: Conexoes SSH ativas e MaxStartups
+        shell: bash
+        run: |
+          echo "=== Conexoes na porta 60000 ==="
+          ss -tnp | grep ':60000' || echo "Nenhuma conexao ativa"
+          echo ""
+          echo "=== MaxStartups configurado ==="
+          sudo sshd -T 2>/dev/null | grep -i maxstartups || grep -i maxstartups /etc/ssh/sshd_config || echo "Configuracao padrao (10:30:100)"
+
+      - name: Quem esta logado
+        shell: bash
+        run: |
+          echo "=== Sessoes ativas ==="
+          who || true
+          echo ""
+          echo "=== Ultimos logins ==="
+          last -n 10 || true