## Summary
- add a persistent Gitea guest on Pikachu at temporary address `10.23.20.127`
- route Git HTTP and SSH through the reverse proxy on public port 22
- configure Gitea SSH clone URLs, trusted forwarding headers, and local SSH clients
## Validation
- `nix run .#fix`
- `nix build .#nixosConfigurations.pikachu.config.system.build.toplevel`
- `nix build .#nixosConfigurations.zeus.config.system.build.toplevel`
- `nix build .#nixosConfigurations.neogaia.config.system.build.toplevel`
Follow-up: this PR now retains the existing Gitea LXC HTTP and SSH routes. The new Pikachu guest is declared but receives no public git.alexion.dev traffic yet.
Follow-up: this PR now retains the existing Gitea LXC HTTP and SSH routes. The new Pikachu guest is declared but receives no public `git.alexion.dev` traffic yet.
Follow-up: permit HTTP session cookies while Gitea remains off the public HTTPS route, so the initial administrator can sign in. The next follow-up restores secure cookies and disables registration.
Follow-up: permit HTTP session cookies while Gitea remains off the public HTTPS route, so the initial administrator can sign in. The next follow-up restores secure cookies and disables registration.
Follow-up: permit the old Gitea canonical HTTPS URL during repository migration; the source advertises git.alexion.dev even when its private address begins the migration.
Follow-up: permit the old Gitea canonical HTTPS URL during repository migration; the source advertises `git.alexion.dev` even when its private address begins the migration.
Follow-up: permit only the canonical old Gitea URL and its internal reverse-proxy address for migration. Use https://git.alexion.dev/alexion/dev.git as the source URL.
Follow-up: permit only the canonical old Gitea URL and its internal reverse-proxy address for migration. Use `https://git.alexion.dev/alexion/dev.git` as the source URL.
Follow-up: allow both HTTP and HTTPS for the old canonical Gitea host and its internal reverse-proxy address. The old API advertises http://git.alexion.dev/... as the clone URL, which redirects to HTTPS.
Follow-up: allow both HTTP and HTTPS for the old canonical Gitea host and its internal reverse-proxy address. The old API advertises `http://git.alexion.dev/...` as the clone URL, which redirects to HTTPS.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
10.23.20.127Validation
nix run .#fixnix build .#nixosConfigurations.pikachu.config.system.build.toplevelnix build .#nixosConfigurations.zeus.config.system.build.toplevelnix build .#nixosConfigurations.neogaia.config.system.build.toplevelFollow-up: this PR now retains the existing Gitea LXC HTTP and SSH routes. The new Pikachu guest is declared but receives no public
git.alexion.devtraffic yet.Follow-up: permit HTTP session cookies while Gitea remains off the public HTTPS route, so the initial administrator can sign in. The next follow-up restores secure cookies and disables registration.
Follow-up: disable Gitea self-registration after initial administrator setup. HTTP bootstrap access remains enabled until the public HTTPS cutover.
Follow-up: allow the Gitea guest to import only from the old LXC at
10.23.20.45:3000during repository migration.Follow-up: permit the old Gitea canonical HTTPS URL during repository migration; the source advertises
git.alexion.deveven when its private address begins the migration.Follow-up: permit only the canonical old Gitea URL and its internal reverse-proxy address for migration. Use
https://git.alexion.dev/alexion/dev.gitas the source URL.Follow-up: allow both HTTP and HTTPS for the old canonical Gitea host and its internal reverse-proxy address. The old API advertises
http://git.alexion.dev/...as the clone URL, which redirects to HTTPS.Follow-up: pin the verified Gitea RSA, ECDSA, and Ed25519 SSH host keys for managed clients.
Follow-up: declare the Gitea HTTPS route with the Gitea guest, removing its legacy manual reverse-proxy virtual host.
Follow-up: inline the Gitea SSH backend address because the reverse-proxy stream is its sole consumer.
Follow-up: make the Gitea trusted-proxy address optional so the service module also supports direct local deployments.
Follow-up: add Gitea to the Homepage dashboard.
Squashed the pull request to one commit.
aa3ddf78b6tod342370b89