diff --git a/systems/jeeves/services/gitea.nix b/systems/jeeves/services/gitea.nix
index 988da6f..3e84d3d 100644
--- a/systems/jeeves/services/gitea.nix
+++ b/systems/jeeves/services/gitea.nix
@@ -26,10 +26,14 @@ in
       };
       service.DISABLE_REGISTRATION = true;
       server = {
-        DOMAIN = "tmmworkshop.com";
+        DOMAIN = "gitea.tmmworkshop.com";
         ROOT_URL = "https://gitea.tmmworkshop.com/";
         HTTP_PORT = 6443;
+        BUILTIN_SSH_SERVER_USER = "gitea";
+        SSH_USER = "gitea";
+        SSH_DOMAIN = "gitea.tmmworkshop.com";
         SSH_PORT = 2223;
+        SSH_LISTEN_HOST = "0.0.0.0";
         SSH_LISTEN_PORT = 2223;
         START_SSH_SERVER = true;
         PUBLIC_URL_DETECTION = "auto";
diff --git a/systems/portal-1/haproxy/default.nix b/systems/portal-1/haproxy/default.nix
index 82c4819..a885da4 100644
--- a/systems/portal-1/haproxy/default.nix
+++ b/systems/portal-1/haproxy/default.nix
@@ -35,6 +35,7 @@ in
   networking.firewall.allowedTCPPorts = [
     80
     443
+    2223
   ];
 
   # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).
diff --git a/systems/portal-1/haproxy/haproxy.cfg b/systems/portal-1/haproxy/haproxy.cfg
index 8800b17..36ada84 100644
--- a/systems/portal-1/haproxy/haproxy.cfg
+++ b/systems/portal-1/haproxy/haproxy.cfg
@@ -110,6 +110,14 @@ frontend ContentSwitching
   use_backend gems  if host_gems
   use_backend norn_sight  if host_norn_sight
 
+# Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
+# available to Endlessh on Portal.
+frontend GiteaSSH
+  bind *:2223 v4v6
+  mode tcp
+  option tcplog
+  default_backend gitea_ssh
+
 # Stick-table only (no servers): tracks per-IP request rate to Gitea's compare
 # endpoint over a 5-minute window so the frontend can cap it at 1 per 5 min.
 backend st_compare
@@ -120,7 +128,7 @@ backend st_gems_join
 
 backend acme_challenge
   mode http
-  server acme 127.0.0.1:8080
+  server acme 127.0.0.1:8402
 
 backend audiobookshelf_nodes
   mode http
@@ -143,6 +151,10 @@ backend gitea
   mode http
   server server jeeves:6443
 
+backend gitea_ssh
+  mode tcp
+  server gitea jeeves:2223
+
 backend gems
   mode http
   option forwardfor
diff --git a/users/richie/home/ssh_config.nix b/users/richie/home/ssh_config.nix
index 2bd41de..9074a26 100644
--- a/users/richie/home/ssh_config.nix
+++ b/users/richie/home/ssh_config.nix
@@ -49,6 +49,12 @@
         IdentityFile = "~/.ssh/id_ed25519";
         Port = 278;
       };
+      "gitea.tmmworkshop.com" = {
+        HostName = "gitea.tmmworkshop.com";
+        User = "gitea";
+        IdentityFile = "~/.ssh/id_ed25519";
+        Port = 2223;
+      };
     };
   };
 }