feat(portal): proxy Gitea SSH through HAProxy

- expose Gitea SSH through Portal on port 2223
- advertise the correct Gitea SSH user and domain
- add the Gitea host to Richie’s SSH config
- correct the local ACME challenge backend port

systems/jeeves/services/gitea.nix

@@ -26,10 +26,14 @@ in
       };
       service.DISABLE_REGISTRATION = true;
       server = {
-        DOMAIN = "tmmworkshop.com";
+        DOMAIN = "gitea.tmmworkshop.com";
         ROOT_URL = "https://gitea.tmmworkshop.com/";
         HTTP_PORT = 6443;
+        BUILTIN_SSH_SERVER_USER = "gitea";
+        SSH_USER = "gitea";
+        SSH_DOMAIN = "gitea.tmmworkshop.com";
         SSH_PORT = 2223;
+        SSH_LISTEN_HOST = "0.0.0.0";
         SSH_LISTEN_PORT = 2223;
         START_SSH_SERVER = true;
         PUBLIC_URL_DETECTION = "auto";

systems/portal-1/haproxy/default.nix

@@ -35,6 +35,7 @@ in
   networking.firewall.allowedTCPPorts = [
     80
     443
+    2223
   ];
 
   # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).

systems/portal-1/haproxy/haproxy.cfg

@@ -110,6 +110,14 @@ frontend ContentSwitching
   use_backend gems  if host_gems
   use_backend norn_sight  if host_norn_sight
 
+# Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
+# available to Endlessh on Portal.
+frontend GiteaSSH
+  bind *:2223 v4v6
+  mode tcp
+  option tcplog
+  default_backend gitea_ssh
+
 # Stick-table only (no servers): tracks per-IP request rate to Gitea's compare
 # endpoint over a 5-minute window so the frontend can cap it at 1 per 5 min.
 backend st_compare
@@ -120,7 +128,7 @@ backend st_gems_join
 
 backend acme_challenge
   mode http
-  server acme 127.0.0.1:8080
+  server acme 127.0.0.1:8402
 
 backend audiobookshelf_nodes
   mode http
@@ -143,6 +151,10 @@ backend gitea
   mode http
   server server jeeves:6443
 
+backend gitea_ssh
+  mode tcp
+  server gitea jeeves:2223
+
 backend gems
   mode http
   option forwardfor

users/richie/home/ssh_config.nix

@@ -49,6 +49,12 @@
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 278;
       };
+      "gitea.tmmworkshop.com" = {
+        HostName = "gitea.tmmworkshop.com";
+        User = "gitea";
+        IdentityFile = "~/.ssh/id_ed25519";
+        Port = 2223;
+      };
     };
   };
 }