forgejo: reach git+ssh from off-LAN via a relayd TCP relay on 2022

The NodePort is LAN-only, so the advertised clone URL
(ssh://git@r0.lan.buetow.org:30222/...) did not work from outside. Add a plain
TCP relay on the gateways forwarding 2022 to NodePort 30222, and have Forgejo
advertise code.f3s.buetow.org:2022.

Port 2022 rather than 22: the gateways run their own sshd on port 2, so 22 was
in fact free, but leaving the forge off the default port keeps it clear of the
mass scanning that port attracts. That is noise reduction and not security --
the real protection is that Forgejo's SSH does key-only auth for git operations
and offers no shell. 2222 would have been the conventional choice but dserver
(DTail) already holds it on the gateways; verified 2022 free on both.

The relay carries no "protocol" line, so relayd forwards the stream untouched.
TLS must not be involved: SSH secures its own transport and the client verifies
Forgejo's host key at the far end. A dedicated <forgejo_ssh> table keeps the
health check on the SSH port, since the web UI can be up while SSH is not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2 files changed, 27 insertions, 8 deletions

diff --git a/f3s/forgejo/README.md b/f3s/forgejo/README.md
index 9758b29..70e6133 100644
--- a/f3s/forgejo/README.md
+++ b/f3s/forgejo/README.md
@@ -112,10 +112,26 @@ just create-admin
 # HTTPS
 git clone https://code.f3s.buetow.org/<user>/<repo>.git
 
-# SSH (NodePort; LAN only unless you forward it)
+# SSH, from anywhere -- relayd listens on 2022 and TCP-forwards to the NodePort
+git clone ssh://git@code.f3s.buetow.org:2022/<user>/<repo>.git
+
+# SSH direct to a node, bypassing the gateways (LAN only)
 git clone ssh://git@r0.lan.buetow.org:30222/<user>/<repo>.git
 ```
 
+Port 2022 rather than 22 keeps the forge away from the mass scanning the default
+port attracts; 2222 was unavailable, dserver (DTail) already uses it on the
+gateways. To administer blowfish/fishfinger, SSH is on port 2 as usual.
+
+To use the short `git@code.f3s.buetow.org:user/repo.git` form, put the port in
+`~/.ssh/config`:
+
+```
+Host code.f3s.buetow.org
+  Port 2022
+  User git
+```
+
 ## Operations
 
 ```sh
diff --git a/f3s/forgejo/helm-chart/templates/deployment.yaml b/f3s/forgejo/helm-chart/templates/deployment.yaml
index ba19dfa..73c5704 100644
--- a/f3s/forgejo/helm-chart/templates/deployment.yaml
+++ b/f3s/forgejo/helm-chart/templates/deployment.yaml
@@ -96,15 +96,18 @@ spec:
           value: "true"
         - name: FORGEJO__server__SSH_LISTEN_PORT
           value: "2222"
-        # SSH_DOMAIN is deliberately NOT code.f3s.buetow.org: that name resolves
-        # to the OpenBSD gateways, which forward 443 only, and *.f3s.lan points
-        # at the CARP storage VIP rather than a k3s node. Advertise a node that
-        # actually answers on the NodePort, so the clone URLs Forgejo renders
-        # are ones that work.
+        # relayd listens on 2022 on the gateways and TCP-forwards to NodePort
+        # 30222, so git+ssh works from off-LAN (see relay "forgejo_ssh4" in
+        # frontends/etc/relayd.conf.tpl). Not 22: that keeps the forge clear of
+        # the constant scanning on the default port. Not 2222 either -- dserver
+        # already holds that on the gateways.
+        #
+        # SSH_PORT is what Forgejo advertises in clone URLs (2022, via relayd);
+        # SSH_LISTEN_PORT above is what the container actually binds (2222).
         - name: FORGEJO__server__SSH_DOMAIN
-          value: "r0.lan.buetow.org"
+          value: "code.f3s.buetow.org"
         - name: FORGEJO__server__SSH_PORT
-          value: "30222"
+          value: "2022"
 
         # Behind relayd -> Traefik, Forgejo's default trusts only 127.0.0.0/8,
         # so every request would be attributed to the Traefik pod IP: real client