Erich Blume
1184b4de1d
## Summary - Add layer4 TCP proxy configuration to Caddyfile template for SSH services - Configure Forgejo SSH on port 2222 → localhost:2200 - Switch HTTPS from port 8443 (testing) to 443 (production) - Requires Caddy rebuilt with `github.com/mholt/caddy-l4` plugin ## What This Enables Git+SSH access via `forge.ops.eblu.me:2222` is now accessible from: - Tailnet clients (gilbert) - Docker containers on indri - Kubernetes pods in minikube This solves the DNS resolution issues where containers couldn't reach Tailscale MagicDNS names. ## Testing Done - [x] Caddy rebuilt with layer4 plugin - [x] Validated Caddyfile syntax - [x] Cleared `svc:forge` from tailscale serve - [x] Verified HTTPS works: `curl https://forge.ops.eblu.me` - [x] Verified SSH works: `ssh -p 2222 forgejo@forge.ops.eblu.me` - [x] Verified git clone works via new endpoint - [x] Verified minikube pods can reach both HTTPS and SSH endpoints ## Deployment Caddy is already running with the new config on indri. This PR captures the ansible changes. ## Next Steps - Update zk docs with new git remote format - Migrate registry and other services to Caddy - Retire tailscale_services ansible role 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/56
23 lines
704 B
YAML
23 lines
704 B
YAML
# DEPRECATED: This egress proxy is no longer needed.
|
|
# Forge is now accessible via Caddy at forge.ops.eblu.me (HTTPS) and
|
|
# forge.ops.eblu.me:2222 (SSH), which pods can reach directly.
|
|
#
|
|
# Keeping this file for reference during migration. Remove once verified.
|
|
#
|
|
# Original purpose: Egress proxy to expose Forgejo (forge) to the cluster
|
|
# See: https://tailscale.com/kb/1438/kubernetes-operator-cluster-egress
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: forge
|
|
namespace: tailscale
|
|
annotations:
|
|
tailscale.com/tailnet-fqdn: indri.tail8d86e.ts.net
|
|
tailscale.com/proxy-class: "default"
|
|
spec:
|
|
type: ExternalName
|
|
externalName: placeholder
|
|
ports:
|
|
- port: 3001
|
|
targetPort: 3001
|