c284158dfb
- gitea-sshd svc targetPort 22->2222 (rootless gitea binds non-privileged 2222) - netpol ingress ssh port 22->2222 (NetworkPolicy ports are POD ports, not svc ports) SSH over ssh://git@git.fxhnt.ai now works (port 22 via proxy socat -> 2222).
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
# The gitea chart's gitea-http/gitea-ssh services are HEADLESS (clusterIP: None), so they resolve to the
|
|
# pod IP (100.64.x.x). That range OVERLAPS the Tailscale CGNAT range (100.64.0.0/10), so the tailscale
|
|
# sidecar in the tailscale-gitlab-proxy pod swallows traffic to the pod IP. These normal ClusterIP services
|
|
# give Gitea a service IP in the service CIDR (10.32.x.x, outside the tailscale range) — the proxy nginx +
|
|
# socat target these instead. (GitLab worked because its webservice svc was a normal ClusterIP.)
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-web
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/name: gitea
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: gitea
|
|
app.kubernetes.io/instance: gitea
|
|
ports:
|
|
- name: http
|
|
port: 3000
|
|
targetPort: 3000
|
|
protocol: TCP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-sshd
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/name: gitea
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: gitea
|
|
app.kubernetes.io/instance: gitea
|
|
ports:
|
|
- name: ssh
|
|
port: 22
|
|
targetPort: 2222 # rootless gitea listens on 2222 internally (can't bind privileged 22)
|
|
protocol: TCP
|