Hi, how do you run forgejo under a reverse proxy while using an ssh channel to pull/push commits?
From what I understand caddy is only able to proxy http traffic.
IIRC there is a plugin for Caddy that can do what you are looking for.
Edit: here you go
This would only work if there is no other traffic on the port being used (eg: port 22). If both the host SSH service and Forgejo SSH service expect traffic on port 22, then this would not work since server name indication (SNI) is not provided with SSH traffic and Caddy would not be able to identify the appropriate destination for multiple SSH services traffic.
Not really through Caddy but for my setup I have it so the ssh port for Forgejo is only accessible through tailscale. So for push/pulling updated my ssh config file to something like
Host git.mysite.com HostName tailscaleMachineName User git Port 1234
Then doing git pull git@git.mysite.com:user/project.git works just fine as long as I am connected to tailscale
Otherwise you could open the port for Forgejo’s ssh so that you can access it without any vpn
I feel silly for not realizing that the SSH config would be used by Git!
I thought if Forgejo’s SSH service listened to a non-standard port that you would have to do commands with the port in the command similar to below (following your example). I guess I assumed Git did not directly use the client’s SSH service.
git pull git@git.mysite.com:1234:user/project.git
I dont know about caddy but nginx proxy manager does this very well. Also, if running in docker, you can expose the port that runs ssh for forgejo und a different port than the host machine‘s (eg 2222). In that case you just put the remote in with the port and call it a day.
I can’t give you the technical explanation, but it works.
My Caddyfile only something like this
@forgejo host forgejo.pe1uca
handle @forgejo {
reverse_proxy :8000
}
and everything else has worked properly cloning via ssh with git@forgejo.pe1uca:pe1uca/my_repo.git
My guess is git only needs the host to resolve the IP and then connects to the port directly.
I believe the reverse proxy settings in your post is just configured to handle the http/https connection, not the SSH connection. Instead, SSH connections are likely being routed to the machine running Foegejo via DNS and your reverse proxy is not involved with anything related to SSH.
I assume you either have SSH disabled on your host or SSH on your host uses a port other than 22?
Afaik you can reverse proxy the ssh connection. I’ve been connecting to my server using the domain and tld (asudox.dev)
Are you able to provide some details on how you are doing this? I don’t think you can do much with reverse proxies and SSH beyond routing all traffic on port 22 (or the configured SSH port) to whichever port SSH is listening on. In other words, the reverse proxy cannot route SSH traffic for the host on port 22 to the host, route SSH traffic for Forgejo on port 22 to Forgejo’s SSH process, and SFTP traffic on port 22 to the SFTP process - at least not via domain name like a HTTP/HTTPS reverse proxy would work.
Instead, this would need to be done via IP address where the host SSH process listens on 192.168.1.2, the Forgejo SSH process listens on 192.168.1.3, and the SFTP process listens on 192.168.4. Otherwise, each of those services would need to use different ports.
