Date: 2026-03-22
Restored Git SSH access for gitea.app.lan:222 after the existing forward on kryptovisor was no longer able to reach drg-k8s on 192.168.1.9:222.
The legacy forward path on kryptovisor used an alpine/socat container listening on 0.0.0.0:222 and forwarding to 192.168.1.9:222.
That upstream TCP connect was timing out from kryptovisor, so SSH never reached the Gitea pod.
Two managed services were added on drg-k8s.auth.home.lan:
gitea-ssh-portforward.service
kubectl port-forward --address 0.0.0.0 deploy/gitea 2222:22gitea-ssh-reverse-tunnel.service
ssh -R 2299:127.0.0.1:2222 ax_julian@kryptovisorThe gitea-ssh-forward container on kryptovisor was repointed to:
0.0.0.0:222127.0.0.1:2299Effective path now:
client -> kryptovisor:222 -> gitea-ssh-forward container -> kryptovisor localhost:2299 -> reverse SSH tunnel -> drg-k8s localhost:2222 -> kubectl port-forward -> gitea pod:22
Validated on 2026-03-22 with:
git@gitea.app.lan:222git ls-remote ssh://git@gitea.app.lan/ax_bechju1/JobAndApplication.gitObserved result: Git SSH access succeeded and returned the main branch ref.
kryptovisor -> 192.168.1.9:222 TCP reachability.gitea-ssh-forward container on kryptovisor remains required.systemctl status gitea-ssh-portforward.servicesystemctl status gitea-ssh-reverse-tunnel.servicedocker logs gitea-ssh-forward on kryptovisor