From 84da4bacc504ecef4e43d8aadfa7d7d16042119c Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Sun, 19 Jul 2026 22:22:39 +0200 Subject: [PATCH] neptun: forward :2222 to jupiter's gitea SSH server Caddy only proxies HTTP; git-over-ssh to gitea needs a raw TCP forward since gitea's built-in SSH server (jupiter:2222) isn't otherwise reachable from the public internet. socat forwards the VPS's public :2222 over the tailnet. Matches what's now live on the (still-Debian) VPS - ready to drop in once neptun gets migrated to this NixOS config. Co-Authored-By: Claude Sonnet 5 --- hosts/neptun/configuration.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hosts/neptun/configuration.nix b/hosts/neptun/configuration.nix index 9150c29..c70e6c8 100644 --- a/hosts/neptun/configuration.nix +++ b/hosts/neptun/configuration.nix @@ -48,5 +48,25 @@ ''; # TODO: port your other VPS services' vhosts here before deploying. + # ---- Gitea SSH forward ---- + # Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's + # own built-in SSH server runs on jupiter:2222 (see services/gitea.nix — + # not :222, the unpriv gitea user can't bind <1024). Forward this VPS's + # public :2222 to it over the tailnet, so `ssh://git@git.mgaction.town:2222/...` + # reaches gitea. Needs a matching inbound-2222 rule in netcup's *edge* + # firewall panel too (separate from this box's own, and not managed by Nix). + systemd.services.gitea-ssh-forward = { + description = "Forward :2222 to jupiter's gitea SSH server over tailscale"; + after = [ "network-online.target" "tailscaled.service" ]; + wants = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + DynamicUser = true; + ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork,reuseaddr TCP:jupiter.hosts.mgaction.town:2222"; + Restart = "always"; + }; + }; + networking.firewall.allowedTCPPorts = [ 2222 ]; + system.stateVersion = "26.05"; # set at install time; do NOT bump on upgrades }