diff options
| author | Paul Buetow <paul@buetow.org> | 2026-07-26 11:37:47 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-07-26 11:37:47 +0300 |
| commit | 0bcc97a819d6578d41754512376b31fff66b1bce (patch) | |
| tree | 75c33af205dd7517d172e3760a8d9e8d3393aa40 /frontends | |
| parent | a3692f68bace2dc171dbceed274bc26eeadd38aa (diff) | |
forgejo: reach git+ssh from off-LAN via a relayd TCP relay on 2022
The NodePort is LAN-only, so the advertised clone URL
(ssh://git@r0.lan.buetow.org:30222/...) did not work from outside. Add a plain
TCP relay on the gateways forwarding 2022 to NodePort 30222, and have Forgejo
advertise code.f3s.buetow.org:2022.
Port 2022 rather than 22: the gateways run their own sshd on port 2, so 22 was
in fact free, but leaving the forge off the default port keeps it clear of the
mass scanning that port attracts. That is noise reduction and not security --
the real protection is that Forgejo's SSH does key-only auth for git operations
and offers no shell. 2222 would have been the conventional choice but dserver
(DTail) already holds it on the gateways; verified 2022 free on both.
The relay carries no "protocol" line, so relayd forwards the stream untouched.
TLS must not be involved: SSH secures its own transport and the client verifies
Forgejo's host key at the far end. A dedicated <forgejo_ssh> table keeps the
health check on the SSH port, since the web UI can be up while SSH is not.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Diffstat (limited to 'frontends')
| -rw-r--r-- | frontends/etc/relayd.conf.tpl | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/frontends/etc/relayd.conf.tpl b/frontends/etc/relayd.conf.tpl index 02b4887..8a53ed3 100644 --- a/frontends/etc/relayd.conf.tpl +++ b/frontends/etc/relayd.conf.tpl @@ -48,6 +48,15 @@ table <garage> { 192.168.2.132 } +# Forgejo git+ssh backends (NodePort 30222 on the k3s nodes, over WireGuard). +# Separate table from <f3s> so the health check tracks the SSH port specifically: +# the web UI can be up while the built-in SSH server is not. +table <forgejo_ssh> { + 192.168.2.120 + 192.168.2.121 + 192.168.2.122 +} + # Local OpenBSD httpd table <localhost> { 127.0.0.1 @@ -234,6 +243,31 @@ relay "gemini6" { forward to 127.0.0.1 port 11965 } +# Forgejo git+ssh. +# +# Port 2022, deliberately not 22: leaving the forge off the default port keeps +# it out of the way of the mass scanners that hammer 22 continuously. That is +# noise reduction, not security -- the actual protection is that Forgejo's SSH +# server does key-only auth for git operations and offers no shell. +# +# 2222 was the obvious alternative but is already taken here by dserver (DTail). +# +# Plain TCP relay: no "protocol" line, so relayd forwards the stream untouched. +# TLS is not involved and must not be -- SSH does its own transport security, +# and the client verifies Forgejo's own host key at the far end. +# +# Only the gateway currently holding the code.f3s.buetow.org address actually +# receives connections; the other listens harmlessly. +relay "forgejo_ssh4" { + listen on <%= $ipv4address->($hostname) %> port 2022 + forward to <forgejo_ssh> port 30222 check tcp +} + +relay "forgejo_ssh6" { + listen on <%= $ipv6address->($hostname) %> port 2022 + forward to <forgejo_ssh> port 30222 check tcp +} + relay "f3s_static_proxy4" { listen on 127.0.0.1 port 18080 forward to <f3s_static> port 80 check tcp |