docs(plan): SSH on :22 only, retire :2222, update remotes (Phase 2B refinement)

docs/superpowers/plans/2026-06-21-gitea-replace-gitlab.md

@@ -130,8 +130,8 @@ gitea:
       ROOT_URL: https://git.fxhnt.ai/
       DOMAIN: git.fxhnt.ai
       SSH_DOMAIN: git.fxhnt.ai
-      SSH_PORT: "22"            # advertise clean git@git.fxhnt.ai in NEW clone URLs; legacy :2222 still
-                               # works via the proxy (Task 5). Port 22 is free — nothing host-SSHes the git node.
+      SSH_PORT: "22"            # clean git@git.fxhnt.ai clone URLs. Port 22 is free (nothing host-SSHes
+                               # the git node); :2222 retired, local remotes updated in Task 5 Step 2b.
       DISABLE_SSH: "false"
     database:
       DB_TYPE: postgres
@@ -297,28 +297,26 @@ to:
 Delete the entire `listen 5050 ssl; server_name git.fxhnt.ai;` registry block (Scaleway registry is
 external — not proxied).
 
-- [ ] **Step 2: Repoint the socat SSH proxy → Gitea SSH, on BOTH `:22` and `:2222`**
+- [ ] **Step 2: Repoint the socat SSH proxy to Gitea SSH on `:22` (drop `:2222`)**
 
-Nothing ever SSHes into the git node itself, so port `22` is free for git-SSH. Expose Gitea SSH on both
-the standard `:22` (clean `git@git.fxhnt.ai` URLs) and the legacy `:2222` (existing remotes keep working —
-no churn). In the `ssh-proxy` container args, change the existing `:2222` target to Gitea:
+Nothing host-SSHes the git node, so use the standard port `22` and retire `:2222` entirely (clean
+`git@git.fxhnt.ai` URLs). In the `ssh-proxy` container args, change the listen port to `22` and the target
+to Gitea:
 ```
-            - "TCP-LISTEN:2222,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576"
-            - "TCP:gitea-ssh.foxhunt.svc.cluster.local:22,sndbuf=1048576,rcvbuf=1048576"
-```
-Then add a SECOND socat container in the same pod for `:22` (duplicate the `ssh-proxy` container, rename
-`ssh-proxy-22`, listen on `22`, `containerPort: 22`):
-```yaml
-        - name: ssh-proxy-22
-          image: alpine/socat:latest
-          args:
             - "TCP-LISTEN:22,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576"
             - "TCP:gitea-ssh.foxhunt.svc.cluster.local:22,sndbuf=1048576,rcvbuf=1048576"
-          ports:
-            - containerPort: 22
 ```
-Ensure the Tailscale node/proxy advertises both ports `22` and `2222` (the tailnet sidecar's exposed
-ports / `serve` config — add `22` alongside the existing `2222`).
+Update the container `ports:` entry from `containerPort: 2222` → `containerPort: 22`. Ensure the Tailscale
+node/proxy advertises port `22` (update the tailnet sidecar's exposed ports / `serve` config: `22`,
+replacing `2222`).
+
+- [ ] **Step 2b: Update local git remotes from `:2222` → default (port 22)**
+```bash
+cd /home/jgrusewski/Work/foxhunt && git remote set-url origin ssh://git@git.fxhnt.ai/gitadmin/foxhunt.git
+cd /home/jgrusewski/Work/fxhnt   && git remote set-url origin ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git
+cd /home/jgrusewski/Work/foxhunt && git remote -v | grep fetch
+```
+Expected: remotes now show `ssh://git@git.fxhnt.ai/...` (no `:2222`).
 
 - [ ] **Step 3: Apply + restart the proxy**
 ```bash
@@ -332,11 +330,10 @@ Expected: rollout complete.
 - [ ] **Step 4: GATE — verify `git.fxhnt.ai` serves Gitea**
 ```bash
 curl -sk https://git.fxhnt.ai/api/healthz | head -c 200; echo
-echo "--- SSH on :2222 (legacy remotes) ---"; git ls-remote ssh://git@git.fxhnt.ai:2222/gitadmin/fxhnt.git HEAD 2>&1 | head -1
-echo "--- SSH on :22 (clean URLs) ---";       git ls-remote ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git HEAD 2>&1 | head -1
+echo "--- SSH on :22 (git@git.fxhnt.ai) ---"; git ls-remote ssh://git@git.fxhnt.ai/gitadmin/fxhnt.git HEAD 2>&1 | head -1
 ```
-Expected: Gitea healthz JSON; BOTH ssh ls-remotes (`:2222` and `:22`) return the HEAD sha (proves Gitea
-web + SSH on both ports on the canonical name). **STOP + rollback (revert this file, re-apply) if any fail.**
+Expected: Gitea healthz JSON; the `:22` ssh ls-remote returns the HEAD sha (proves Gitea web + SSH on the
+canonical name). **STOP + rollback (revert this file, re-apply) if either fails.**
 
 - [ ] **Step 5: Commit (foxhunt repo)**
 ```bash

docs/superpowers/specs/2026-06-21-gitea-replace-gitlab-design.md

@@ -24,9 +24,9 @@ breaking the live cockpit deploy.
   via `git push --mirror` from existing local clones.
 - **Canonical hostname stays `git.fxhnt.ai`** (no permanent `gitea.fxhnt.ai`, no remote-URL churn).
   Gitea comes up internal-only; validate over a port-forward; then cut `git.fxhnt.ai` (HTTPS) + SSH over
-  to Gitea in one switch. **SSH exposed on BOTH `:22` and `:2222`** — nothing host-SSHes the git node so
-  `:22` is free; Gitea advertises the clean `git@git.fxhnt.ai` (`:22`) in new clone URLs while existing
-  `:2222` remotes keep working (no churn). GitLab keeps running (unaddressed) as the 2C-removal fallback.
+  to Gitea in one switch. **SSH on `:22`** (nothing host-SSHes the git node, so the standard port is free);
+  clone URLs become the clean `git@git.fxhnt.ai` and `:2222` is retired (local remotes updated once).
+  GitLab keeps running (unaddressed) as the 2C-removal fallback.
 - **Container registry:** cockpit image → **Scaleway Container Registry** (`rg.fr-par.scw.cloud/bizworx/`,
   namespace exists). Retire the in-cluster GitLab registry. External/managed, no registry pod.
 - **Argo integration:** Gitea push webhook → Argo Events webhook eventsource → sensor → submit
@@ -44,8 +44,8 @@ breaking the live cockpit deploy.
 3. **Exposure:**
    - HTTPS: extend the nginx `*.fxhnt.ai` proxy (`infra/k8s/gitlab/tailscale-proxy.yaml`) — at cutover,
      repoint the `git.fxhnt.ai` server block `proxy_pass` → `gitea-http.foxhunt.svc:3000`.
-   - SSH: expose Gitea SSH on BOTH `:22` and `:2222` via the Tailscale proxy (two socat listeners) at
-     cutover; advertise `:22` in clone URLs, keep `:2222` for existing remotes.
+   - SSH: expose Gitea SSH on `:22` via the Tailscale proxy (socat) at cutover; retire `:2222`; update the
+     two local remotes to `ssh://git@git.fxhnt.ai/...`.
    - Registry `:5050` server block: removed (Scaleway registry is external, not proxied here).
 4. **Registry migration:**
    - `fxhnt/infra/argo/cockpit-build-deploy.yaml`: kaniko `--destination` + `--cache-repo` →