gitea ssh 在端口 222 上可用的示例，因为端口 22 用于主机 ssh。
- 为 traefik 创建一个名为 ssh 的入口点，用于端口 222
- 将端口配置添加到 traefik 容器 222:222/tcp（不需要 udp、sctp）
- 对于 gitea，您不需要公开端口
- 配置gitea，添加环境变量：
# details: https://docs.gitea.io/en-us/config-cheat-sheet/#admin-admin
# start gitea only ssh server, default use system which didn't work for me in any way
GITEA__server__START_SSH_SERVER: "true"
# this port is used in git clone, if not 22 this will add ssh:// to clone url which... i needed to remove everytime
GITEA__server__SSH_PORT: 22
# gitea ssh listen port
GITEA__server__SSH_LISTEN_PORT: 222
- 为带有标签的 gitea 配置 traefik：
# host resolving doesn't work for ssh, so you can only use "*"
- "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
- "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
- "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-svc"
- "traefik.tcp.services.gitea-ssh-svc.loadbalancer.server.port=222"
- 将您的 ssh 密钥添加到您的帐户，检查其类型是否有效，最小位数也是如此。 https://docs.gitea.io/en-us/config-cheat-sheet/#ssh-minimum-key-sizes-sshminimum_key_sizes
- 创建一个名为 Example 的简单存储库
- 客户端更新 ~/.ssh/config:
Host MyGiteaInstance
HostName git.example.de
IdentityFile ~/.ssh/gitea
User username
Port 222
-
clone git@git.example.de:user/Example.git，对我来说，如果 url 中有端口信息或者有 ssh:// 之类的协议前缀，它就会失败
调试提示：
- 检查 traefik 日志是否有找不到入口点等错误
- 使用详细的 ssh 进行克隆：
GIT_SSH_COMMAND="ssh -v" git clone git@git.example.de:user/Example.git
- 如果主机无法访问 -> 您这边的 ssh 端口错误或入口点未在 traefik 中设置
- 主机真实性请求 = traefik 很好，客户端端口配置可能很好（多个 ssh 服务器）
- 权限被拒绝 -> gitea 中的 ssh 服务器已启动，端口设置正确，检查 gitea 日志或 ssh 密钥未添加到用户
如果我错过了上面的内容，请完成不是最小的示例：
networks:
proxy:
external: false
internal: true
web:
external: false
gitea:
external: false
internal: true
volumes:
gitea:
gitea_db:
services:
traefik:
image: traefik:v2.5
command: --api.insecure=true --providers.docker
ports:
# entrypoint http
- "80:80"
# entrypoint https
- "443:443"
# entrypoint ssh
- "222:222/tcp"
# todo maybe behind vpn?
# - "8080:8080"
# todo create docker.sock proxy
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik:/etc/traefik:ro
- ./acme.json:/certs/acme.json
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
networks:
- proxy
- web
watchtower:
image: containrrr/watchtower:latest
environment:
WATCHTOWER_CLEANUP: "true"
WATCHTOWER_REVIVE_STOPPED: "true"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
# disable for container?
# LABEL com.centurylinklabs.watchtower.enable="false"
gitea_db:
image: postgres:14
restart: unless-stopped
environment:
POSTGRES_USER: gitea
POSTGRES_PASSWORD: ${GITEA_DB_PASSWD}
POSTGRES_DB: gitea
networks:
- gitea
volumes:
- gitea_db:/var/lib/postgresql/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
gitea:
image: gitea/gitea:1.15
depends_on:
- gitea_db
# https://docs.gitea.io/en-us/config-cheat-sheet/
environment:
USER_UID: 1000
USER_GID: 1000
# configuration:
# some values are created from the documentation but untested, therefore uncommented
# https://docs.gitea.io/en-us/config-cheat-sheet/#repository---local-repositorylocal
## default
GITEA__default__RUN_MODE: prod
GITEA__default__APP_NAME: "Gitea: Git with a cup of tea"
## database
GITEA__database__DB_TYPE: postgres
GITEA__database__HOST: gitea_db:5432
GITEA__database__NAME: gitea
GITEA__database__USER: gitea
GITEA__database__PASSWD: ${GITEA_DB_PASSWD}
## server
GITEA__server__DOMAIN: ${GITEA_DOMAIN}
# ensuring unneccessary port isnt added
GITEA__server__ROOT_URL: "https://%(DOMAIN)s"
GITEA__server__HTTP_PORT: 80
# if true SSH_LISTEN_PORT needs to be != 22
GITEA__server__START_SSH_SERVER: "true"
# SSH port in clone URL (needs to be 22 to remove ssh:// from clone url)
GITEA__server__SSH_PORT: 22
# disable forced ssh:// prefix of clone url
GITEA__repository__USE_COMPAT_SSH_URI: "false"
# SSH port for built-in SSH server (e.g. docker run ... -p SSH_PORT:LISTEN_PORT)
GITEA__server__SSH_LISTEN_PORT: 222
# mailer
GITEA__mailer__ENABLED: "true"
GITEA__mailer__HOST: "${GITEA_MAIL_HOST}"
GITEA__mailer__FROM: "${GITEA_MAIL}"
GITEA__mailer__USER: "${GITEA_MAIL}"
# require email confirmation to register, enable email notifications
# no effect: GITEA__server__REGISTER_EMAIL_CONFIRM: "true"
# allows mails as notifications on updates
# no effect: GITEA__server__ENABLE_NOTIFY_MAIL: "true"
#
# open-id sign
GITEA__openid__ENABLE_OPENID_SIGNIN: "true"
# disable self-registration
GITEA__service__DISABLE_REGISTRATION: "true"
# require sign in to view pages
GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
# password hash argon2
GITEA__security__PASSWORD_HASH_ALGO: "argon2"
#
# change default branch from master to x
GITEA__repository__DEFAULT_BRANCH: "main"
#
# set manually during install, keys don't work for unknown reason:
# Email Settings:
# SMTP Password:
# GITEA__mailer__PASSWD: "${GITEA_MAIL_PASSWORD}"
# [x] Require Email Confirmation to Register
# [x] Enable Email Notifications (to watch repos / issues aso.)
#
# set manually, no config option found:
# Server and Third-Party Service Settings:
# [x] Enable Local Mode (disable all third party content)
#
# Admin Account:
# admin: ${GITEA_ADMIN_NAME}
# pw: "${GITEA_MAIL_PASSWORD}"
# mail: ${GITEA_MAIL}
#
# check configuration here:
# https://${GITEA_DOMAIN}/admin/config
#
# remember correct port isn't part of ssh clone url, but works with ~/.ssh/config
restart: unless-stopped
networks:
- gitea
- proxy
volumes:
- gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.http.services.gitea.loadbalancer.server.port=80"
- "traefik.http.routers.gitea_insecure.rule=Host(`${GITEA_DOMAIN}`)"
- "traefik.http.routers.gitea_insecure.entrypoints=http"
- "traefik.http.routers.gitea_insecure.middlewares=https-redirect@file"
- "traefik.http.routers.gitea.rule=Host(`${GITEA_DOMAIN}`)"
- "traefik.http.routers.gitea.entrypoints=https"
- "traefik.http.routers.gitea.tls.certresolver=tlsChallenge"
# https://community.traefik.io/t/routing-ssh-traffic-with-traefik-v2/717
# ssh cant be set on specific domain
- "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
- "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
- "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-svc"
- "traefik.tcp.services.gitea-ssh-svc.loadbalancer.server.port=222"
.env 文件：
GITEA_DOMAIN=git.example.de
GITEA_DB_PASSWD=securePassword
GITEA_ADMIN_NAME=admin name
GITEA_MAIL_PASSWORD=securePassword
GITEA_MAIL_HOST=smtp.mymail.de:465
GITEA_MAIL=yourEmail
./traefik/dynamic.yml
http:
middlewares:
https-redirect:
redirectScheme:
scheme: https
./traefik/traefik.yml
global:
sendAnonymousUsage: false
log:
level: INFO
entryPoints:
http:
address: :80
https:
address: :443
ssh:
address: :222
defaultEntryPoints:
- https
api:
insecure: true
dashboard: true
providers:
docker:
endpoint: unix:///var/run/docker.sock
watch: true
exposedByDefault: false
network: shared_proxy
file:
filename: /etc/traefik/dynamic.yml
watch: true
certificatesResolvers:
tlsChallenge:
acme:
email: MyEmailAdress
storage: /certs/acme.json
tlsChallenge: {}
# https://doc.traefik.io/traefik/https/acme/#caserver
# caServer: https://acme-staging-v02.api.letsencrypt.org/directory # For test certificates