Caddy only proxies HTTP; git-over-ssh to gitea needs a raw TCP forward since gitea's built-in SSH server (jupiter:2222) isn't otherwise reachable from the public internet. socat forwards the VPS's public :2222 over the tailnet. Matches what's now live on the (still-Debian) VPS - ready to drop in once neptun gets migrated to this NixOS config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>