Add Caddy layer4 for Forgejo SSH #56

Merged
eblume merged 4 commits from feature/caddy-layer4-forge into main 2026-01-25 11:37:24 -08:00

4 commits

Author SHA1 Message Date
f7cc30850b Remove forge from tailscale_serve role
Forge has been migrated to Caddy at forge.ops.eblu.me.
Registry remains on tailscale serve until migrated.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 11:36:46 -08:00
8be959929c Update all forge references to use ops.eblu.me domain
- Update CLAUDE.md mirror location
- Update ansible managed header to use new SSH URL with port 2222
- Update Brewfile comment
- Update alloy build instructions
- Update mise tasks (pr-comments, indri-runner-logs, indri-services-check, container-tag-and-release)
- Update nettest connectivity script
- Mark tailscale-operator egress-forge as deprecated (pods can now reach forge directly via Caddy)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 11:35:05 -08:00
1c5fcd15d8 Update Forgejo config to use new ops.eblu.me domain
- Change domain from forge.tail8d86e.ts.net to forge.ops.eblu.me
- Update SSH_PORT from 22 to 2222 (external port via Caddy L4)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 11:32:14 -08:00
a2fd688865 Add Caddy layer4 support for Forgejo SSH
- Add layer4 TCP proxy configuration to Caddyfile template
- Configure SSH service on port 2222 → localhost:2200 (Forgejo)
- Switch HTTPS port from 8443 (testing) to 443 (production)
- Requires Caddy rebuilt with github.com/mholt/caddy-l4 plugin

This enables git+ssh access via forge.ops.eblu.me:2222, accessible
from tailnet clients, docker containers, and k8s pods alike.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 11:20:04 -08:00