From c284158dfb66cf33e94e15949fa1afe93c7c33e5 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 21 Jun 2026 17:04:42 +0200
Subject: [PATCH] =?UTF-8?q?fix(infra):=20gitea=20SSH=20ports=20=E2=80=94?=
 =?UTF-8?q?=20rootless=20listens=20on=202222=20(Phase=202B)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gitea-sshd svc targetPort 22->2222 (rootless gitea binds non-privileged 2222)
- netpol ingress ssh port 22->2222 (NetworkPolicy ports are POD ports, not svc ports)
SSH over ssh://git@git.fxhnt.ai now works (port 22 via proxy socat -> 2222).
---
 infra/k8s/gitea/clusterip-services.yaml | 2 +-
 infra/k8s/gitea/networkpolicy.yaml      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/infra/k8s/gitea/clusterip-services.yaml b/infra/k8s/gitea/clusterip-services.yaml
index 2071d6f9c..6056b2eb4 100644
--- a/infra/k8s/gitea/clusterip-services.yaml
+++ b/infra/k8s/gitea/clusterip-services.yaml
@@ -36,5 +36,5 @@ spec:
   ports:
     - name: ssh
       port: 22
-      targetPort: 22
+      targetPort: 2222   # rootless gitea listens on 2222 internally (can't bind privileged 22)
       protocol: TCP
diff --git a/infra/k8s/gitea/networkpolicy.yaml b/infra/k8s/gitea/networkpolicy.yaml
index 35d5ac8ba..bd116540e 100644
--- a/infra/k8s/gitea/networkpolicy.yaml
+++ b/infra/k8s/gitea/networkpolicy.yaml
@@ -22,7 +22,7 @@ spec:
                 values: ["foxhunt", "argo-workflows"]
       ports:
         - { port: 3000, protocol: TCP }
-        - { port: 22, protocol: TCP }
+        - { port: 2222, protocol: TCP }
     # web + ssh from the tailscale proxy (nginx + socat) that fronts git.fxhnt.ai
     - from:
         - podSelector:
@@ -30,7 +30,7 @@ spec:
               app.kubernetes.io/name: tailscale-gitlab-proxy
       ports:
         - { port: 3000, protocol: TCP }
-        - { port: 22, protocol: TCP }
+        - { port: 2222, protocol: TCP }
   egress:
     # PostgreSQL
     - to: