Hi, how do you run forgejo under a reverse proxy while using an ssh channel to pull/push commits?
From what I understand caddy is only able to proxy http traffic.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System Git Popular version control system, primarily for code HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL IP Internet Protocol SFTP Secure File Transfer Protocol for encrypted file transfer, over SSH SSH Secure Shell for remote terminal access SSL Secure Sockets Layer, for transparent encryption TCP Transmission Control Protocol, most often over IP TLS Transport Layer Security, supersedes SSL VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
[Thread #962 for this sub, first seen 10th Sep 2024, 12:25] [FAQ] [Full list] [Contact] [Source code]
There’s really no need to reverse proxy ssh. What are you attempting to accomplish with the reverse proxy exactly? Http proxying allows you to add things like TLS encryption and modify headers. But ssh is a secure protocol already and you can’t really modify much in transit.
There are plenty of valid reasons to want to use a reverse proxy for SSH:
- Maybe there is a Forgejo instance and Gitea instance running on the same server.
- Maybe there is a Prod Forgejo instance and Dev Forgejo instance running on the same server.
- Maybe both Forgejo and an SFTP are running on the same server.
- Maybe Forgejo is running in a cluster like Docker Swarm or Kubernetes
- Maybe there is a desire to have Caddy act as a bastion host due to an inability to run a true bastion host for SSH or reduce maintenance of managing yet another service/server in addition to Caddy
Regardless of the reason, your last point is valid and the real issue here. I do not think it is possible for Caddy to reverse proxy SSH traffic - at least not without additional software (either on the client, server, or both) or some overly complicated (and likely less secure) setup. This may be possible if TCP traffic included SNI information, but unfortunately it does not.
Not really through Caddy but for my setup I have it so the ssh port for Forgejo is only accessible through tailscale. So for push/pulling updated my ssh config file to something like
Host git.mysite.com HostName tailscaleMachineName User git Port 1234
Then doing git pull git@git.mysite.com:user/project.git works just fine as long as I am connected to tailscale
Otherwise you could open the port for Forgejo’s ssh so that you can access it without any vpn
I feel silly for not realizing that the SSH config would be used by Git!
I thought if Forgejo’s SSH service listened to a non-standard port that you would have to do commands with the port in the command similar to below (following your example). I guess I assumed Git did not directly use the client’s SSH service.
git pull git@git.mysite.com:1234:user/project.git
You don’t. That’s not what caddy is. Use a bastion for ssh.
Edit: link https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump
There seems to be mixed reactions to this suggestion. I don’t know enough to understand why.
Because forgejo’s ssh isn’t for a normal ssh service, but rather so that users can access git over ssh.
Now technically, a bastion should work, but it’s not really what people want when they are trying to set up git over ssh. Since git/ssh is a service, rather than an administrative tool, why shouldn’t it be configured within the other tools used for exposes services? (Reverse proxy/caddy).
And in addition to that, people most probably want git/ssh to be available publicly, which a bastion host doesn’t do.
