Hi, how do you run forgejo under a reverse proxy while using an ssh channel to pull/push commits?

From what I understand caddy is only able to proxy http traffic.

  • irotsoma@lemmy.worldEnglish
    2·
    3 months ago

    There’s really no need to reverse proxy ssh. What are you attempting to accomplish with the reverse proxy exactly? Http proxying allows you to add things like TLS encryption and modify headers. But ssh is a secure protocol already and you can’t really modify much in transit.

    • wireless_purposely832@lemmy.worldEnglish
      1·
      2 months ago

      There are plenty of valid reasons to want to use a reverse proxy for SSH:

      • Maybe there is a Forgejo instance and Gitea instance running on the same server.
      • Maybe there is a Prod Forgejo instance and Dev Forgejo instance running on the same server.
      • Maybe both Forgejo and an SFTP are running on the same server.
      • Maybe Forgejo is running in a cluster like Docker Swarm or Kubernetes
      • Maybe there is a desire to have Caddy act as a bastion host due to an inability to run a true bastion host for SSH or reduce maintenance of managing yet another service/server in addition to Caddy

      Regardless of the reason, your last point is valid and the real issue here. I do not think it is possible for Caddy to reverse proxy SSH traffic - at least not without additional software (either on the client, server, or both) or some overly complicated (and likely less secure) setup. This may be possible if TCP traffic included SNI information, but unfortunately it does not.