darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

neptun: forward :2222 to jupiter's gitea SSH server

Browse Source 
Caddy only proxies HTTP; git-over-ssh to gitea needs a raw TCP forward
since gitea's built-in SSH server (jupiter:2222) isn't otherwise reachable
from the public internet. socat forwards the VPS's public :2222 over the
tailnet. Matches what's now live on the (still-Debian) VPS - ready to drop
in once neptun gets migrated to this NixOS config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
darman
2026-07-19 22:22:39 +02:00
co-authored by Claude Sonnet 5
parent 69a63dc615
commit 84da4bacc5
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/neptun/configuration.nix
+20
View File
@@ -48,5 +48,25 @@
''; '';
# TODO: port your other VPS services' vhosts here before deploying. # TODO: port your other VPS services' vhosts here before deploying.
# ---- Gitea SSH forward ----
# Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's
# own built-in SSH server runs on jupiter:2222 (see services/gitea.nix —
# not :222, the unpriv gitea user can't bind <1024). Forward this VPS's
# public :2222 to it over the tailnet, so `ssh://git@git.mgaction.town:2222/...`
# reaches gitea. Needs a matching inbound-2222 rule in netcup's *edge*
# firewall panel too (separate from this box's own, and not managed by Nix).
systemd.services.gitea-ssh-forward = {
description = "Forward :2222 to jupiter's gitea SSH server over tailscale";
after = [ "network-online.target" "tailscaled.service" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
DynamicUser = true;
ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork,reuseaddr TCP:jupiter.hosts.mgaction.town:2222";
Restart = "always";
};
};
networking.firewall.allowedTCPPorts = [ 2222 ];
system.stateVersion = "26.05"; # set at install time; do NOT bump on upgrades system.stateVersion = "26.05"; # set at install time; do NOT bump on upgrades
} }