From f5a0038ab7654eb0d0d73b8d2e1d99cbb25ccf50 Mon Sep 17 00:00:00 2001 From: Richie Cahill Date: Wed, 26 Aug 2026 10:43:21 -0400 Subject: [PATCH] feat(portal): proxy Gitea SSH through HAProxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - expose Gitea SSH through Portal on port 2223 - advertise the correct Gitea SSH user and domain - add the Gitea host to Richie’s SSH config - correct the local ACME challenge backend port --- systems/jeeves/services/gitea.nix | 6 +++++- systems/portal-1/haproxy/default.nix | 1 + systems/portal-1/haproxy/haproxy.cfg | 14 +++++++++++++- users/richie/home/ssh_config.nix | 6 ++++++ 4 files changed, 25 insertions(+), 2 deletions(-) diff --git a/systems/jeeves/services/gitea.nix b/systems/jeeves/services/gitea.nix index 988da6f..3e84d3d 100644 --- a/systems/jeeves/services/gitea.nix +++ b/systems/jeeves/services/gitea.nix @@ -26,10 +26,14 @@ in }; service.DISABLE_REGISTRATION = true; server = { - DOMAIN = "tmmworkshop.com"; + DOMAIN = "gitea.tmmworkshop.com"; ROOT_URL = "https://gitea.tmmworkshop.com/"; HTTP_PORT = 6443; + BUILTIN_SSH_SERVER_USER = "gitea"; + SSH_USER = "gitea"; + SSH_DOMAIN = "gitea.tmmworkshop.com"; SSH_PORT = 2223; + SSH_LISTEN_HOST = "0.0.0.0"; SSH_LISTEN_PORT = 2223; START_SSH_SERVER = true; PUBLIC_URL_DETECTION = "auto"; diff --git a/systems/portal-1/haproxy/default.nix b/systems/portal-1/haproxy/default.nix index 82c4819..a885da4 100644 --- a/systems/portal-1/haproxy/default.nix +++ b/systems/portal-1/haproxy/default.nix @@ -35,6 +35,7 @@ in networking.firewall.allowedTCPPorts = [ 80 443 + 2223 ]; # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg). diff --git a/systems/portal-1/haproxy/haproxy.cfg b/systems/portal-1/haproxy/haproxy.cfg index 8800b17..36ada84 100644 --- a/systems/portal-1/haproxy/haproxy.cfg +++ b/systems/portal-1/haproxy/haproxy.cfg @@ -110,6 +110,14 @@ frontend ContentSwitching use_backend gems if host_gems use_backend norn_sight if host_norn_sight +# Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains +# available to Endlessh on Portal. +frontend GiteaSSH + bind *:2223 v4v6 + mode tcp + option tcplog + default_backend gitea_ssh + # Stick-table only (no servers): tracks per-IP request rate to Gitea's compare # endpoint over a 5-minute window so the frontend can cap it at 1 per 5 min. backend st_compare @@ -120,7 +128,7 @@ backend st_gems_join backend acme_challenge mode http - server acme 127.0.0.1:8080 + server acme 127.0.0.1:8402 backend audiobookshelf_nodes mode http @@ -143,6 +151,10 @@ backend gitea mode http server server jeeves:6443 +backend gitea_ssh + mode tcp + server gitea jeeves:2223 + backend gems mode http option forwardfor diff --git a/users/richie/home/ssh_config.nix b/users/richie/home/ssh_config.nix index 2bd41de..9074a26 100644 --- a/users/richie/home/ssh_config.nix +++ b/users/richie/home/ssh_config.nix @@ -49,6 +49,12 @@ IdentityFile = "~/.ssh/id_ed25519"; Port = 278; }; + "gitea.tmmworkshop.com" = { + HostName = "gitea.tmmworkshop.com"; + User = "gitea"; + IdentityFile = "~/.ssh/id_ed25519"; + Port = 2223; + }; }; }; }