From b21d9b671d1732c8d66fc9025e56b5f8489e67c4 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Sun, 21 Jun 2026 15:49:54 +0200 Subject: [PATCH] docs(plan): SSH on :22 only, retire :2222, update remotes (Phase 2B refinement) --- .../plans/2026-06-21-gitea-replace-gitlab.md | 43 +++++++++---------- .../2026-06-21-gitea-replace-gitlab-design.md | 10 ++--- 2 files changed, 25 insertions(+), 28 deletions(-) diff --git a/docs/superpowers/plans/2026-06-21-gitea-replace-gitlab.md b/docs/superpowers/plans/2026-06-21-gitea-replace-gitlab.md index 02f5ecf29..a683a31c7 100644 --- a/docs/superpowers/plans/2026-06-21-gitea-replace-gitlab.md +++ b/docs/superpowers/plans/2026-06-21-gitea-replace-gitlab.md @@ -130,8 +130,8 @@ gitea: ROOT_URL: https://git.fxhnt.ai/ DOMAIN: git.fxhnt.ai SSH_DOMAIN: git.fxhnt.ai - SSH_PORT: "22" # advertise clean git@git.fxhnt.ai in NEW clone URLs; legacy :2222 still - # works via the proxy (Task 5). Port 22 is free — nothing host-SSHes the git node. + SSH_PORT: "22" # clean git@git.fxhnt.ai clone URLs. Port 22 is free (nothing host-SSHes + # the git node); :2222 retired, local remotes updated in Task 5 Step 2b. DISABLE_SSH: "false" database: DB_TYPE: postgres @@ -297,28 +297,26 @@ to: Delete the entire `listen 5050 ssl; server_name git.fxhnt.ai;` registry block (Scaleway registry is external — not proxied). -- [ ] **Step 2: Repoint the socat SSH proxy → Gitea SSH, on BOTH `:22` and `:2222`** +- [ ] **Step 2: Repoint the socat SSH proxy to Gitea SSH on `:22` (drop `:2222`)** -Nothing ever SSHes into the git node itself, so port `22` is free for git-SSH. Expose Gitea SSH on both -the standard `:22` (clean `git@git.fxhnt.ai` URLs) and the legacy `:2222` (existing remotes keep working — -no churn). In the `ssh-proxy` container args, change the existing `:2222` target to Gitea: +Nothing host-SSHes the git node, so use the standard port `22` and retire `:2222` entirely (clean +`git@git.fxhnt.ai` URLs). In the `ssh-proxy` container args, change the listen port to `22` and the target +to Gitea: ``` - - "TCP-LISTEN:2222,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576" - - "TCP:gitea-ssh.foxhunt.svc.cluster.local:22,sndbuf=1048576,rcvbuf=1048576" -``` -Then add a SECOND socat container in the same pod for `:22` (duplicate the `ssh-proxy` container, rename -`ssh-proxy-22`, listen on `22`, `containerPort: 22`): -```yaml - - name: ssh-proxy-22 - image: alpine/socat:latest - args: - "TCP-LISTEN:22,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576" - "TCP:gitea-ssh.foxhunt.svc.cluster.local:22,sndbuf=1048576,rcvbuf=1048576" - ports: - - containerPort: 22 ``` -Ensure the Tailscale node/proxy advertises both ports `22` and `2222` (the tailnet sidecar's exposed -ports / `serve` config — add `22` alongside the existing `2222`). +Update the container `ports:` entry from `containerPort: 2222` → `containerPort: 22`. Ensure the Tailscale +node/proxy advertises port `22` (update the tailnet sidecar's exposed ports / `serve` config: `22`, +replacing `2222`). + +- [ ] **Step 2b: Update local git remotes from `:2222` → default (port 22)** +```bash +cd /home/jgrusewski/Work/foxhunt && git remote set-url origin ssh://git@git.fxhnt.ai/gitadmin/foxhunt.git +cd /home/jgrusewski/Work/fxhnt && git remote set-url origin ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git +cd /home/jgrusewski/Work/foxhunt && git remote -v | grep fetch +``` +Expected: remotes now show `ssh://git@git.fxhnt.ai/...` (no `:2222`). - [ ] **Step 3: Apply + restart the proxy** ```bash @@ -332,11 +330,10 @@ Expected: rollout complete. - [ ] **Step 4: GATE — verify `git.fxhnt.ai` serves Gitea** ```bash curl -sk https://git.fxhnt.ai/api/healthz | head -c 200; echo -echo "--- SSH on :2222 (legacy remotes) ---"; git ls-remote ssh://git@git.fxhnt.ai:2222/gitadmin/fxhnt.git HEAD 2>&1 | head -1 -echo "--- SSH on :22 (clean URLs) ---"; git ls-remote ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git HEAD 2>&1 | head -1 +echo "--- SSH on :22 (git@git.fxhnt.ai) ---"; git ls-remote ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git HEAD 2>&1 | head -1 ``` -Expected: Gitea healthz JSON; BOTH ssh ls-remotes (`:2222` and `:22`) return the HEAD sha (proves Gitea -web + SSH on both ports on the canonical name). **STOP + rollback (revert this file, re-apply) if any fail.** +Expected: Gitea healthz JSON; the `:22` ssh ls-remote returns the HEAD sha (proves Gitea web + SSH on the +canonical name). **STOP + rollback (revert this file, re-apply) if either fails.** - [ ] **Step 5: Commit (foxhunt repo)** ```bash diff --git a/docs/superpowers/specs/2026-06-21-gitea-replace-gitlab-design.md b/docs/superpowers/specs/2026-06-21-gitea-replace-gitlab-design.md index c1a156b74..34ac8729d 100644 --- a/docs/superpowers/specs/2026-06-21-gitea-replace-gitlab-design.md +++ b/docs/superpowers/specs/2026-06-21-gitea-replace-gitlab-design.md @@ -24,9 +24,9 @@ breaking the live cockpit deploy. via `git push --mirror` from existing local clones. - **Canonical hostname stays `git.fxhnt.ai`** (no permanent `gitea.fxhnt.ai`, no remote-URL churn). Gitea comes up internal-only; validate over a port-forward; then cut `git.fxhnt.ai` (HTTPS) + SSH over - to Gitea in one switch. **SSH exposed on BOTH `:22` and `:2222`** — nothing host-SSHes the git node so - `:22` is free; Gitea advertises the clean `git@git.fxhnt.ai` (`:22`) in new clone URLs while existing - `:2222` remotes keep working (no churn). GitLab keeps running (unaddressed) as the 2C-removal fallback. + to Gitea in one switch. **SSH on `:22`** (nothing host-SSHes the git node, so the standard port is free); + clone URLs become the clean `git@git.fxhnt.ai` and `:2222` is retired (local remotes updated once). + GitLab keeps running (unaddressed) as the 2C-removal fallback. - **Container registry:** cockpit image → **Scaleway Container Registry** (`rg.fr-par.scw.cloud/bizworx/`, namespace exists). Retire the in-cluster GitLab registry. External/managed, no registry pod. - **Argo integration:** Gitea push webhook → Argo Events webhook eventsource → sensor → submit @@ -44,8 +44,8 @@ breaking the live cockpit deploy. 3. **Exposure:** - HTTPS: extend the nginx `*.fxhnt.ai` proxy (`infra/k8s/gitlab/tailscale-proxy.yaml`) — at cutover, repoint the `git.fxhnt.ai` server block `proxy_pass` → `gitea-http.foxhunt.svc:3000`. - - SSH: expose Gitea SSH on BOTH `:22` and `:2222` via the Tailscale proxy (two socat listeners) at - cutover; advertise `:22` in clone URLs, keep `:2222` for existing remotes. + - SSH: expose Gitea SSH on `:22` via the Tailscale proxy (socat) at cutover; retire `:2222`; update the + two local remotes to `ssh://git@git.fxhnt.ai/...`. - Registry `:5050` server block: removed (Scaleway registry is external, not proxied here). 4. **Registry migration:** - `fxhnt/infra/argo/cockpit-build-deploy.yaml`: kaniko `--destination` + `--cache-repo` →