From c3248fde1f3eeb1ade518edd746e87e9da380c13 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Sun, 7 Jun 2026 16:10:30 -0500
Subject: [PATCH] feat(traefik): add TCP SSH entrypoints for Gitea (2221) and
 JARVIS (10171)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- New entrypoints: gitea-ssh/:2221, jarvis-ssh/:10171
- Expose both ports from the Traefik container
- gitea.yml: TCP passthrough router -> 10.1.71.129:2221
- jarvis.yml: TCP passthrough router -> 10.1.71.131:22
- Both use HostSNI(*) — dedicated entrypoints, no TLS wrapping needed
- UniFi to forward both ports to lightning-lane
---
 boilerplates/traefik/compose.yaml       |  4 ++++
 boilerplates/traefik/dynamic/gitea.yml  | 14 ++++++++++++++
 boilerplates/traefik/dynamic/jarvis.yml | 14 ++++++++++++++
 3 files changed, 32 insertions(+)

diff --git a/boilerplates/traefik/compose.yaml b/boilerplates/traefik/compose.yaml
index fa20353..3e397cc 100644
--- a/boilerplates/traefik/compose.yaml
+++ b/boilerplates/traefik/compose.yaml
@@ -16,6 +16,8 @@ services:
       # Entrypoints
       - "--entrypoints.ping.address=:8082"
       - "--entrypoints.web.address=:80"
+      - "--entrypoints.gitea-ssh.address=:2221"
+      - "--entrypoints.jarvis-ssh.address=:10171"
       - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.encodedCharacters.allowEncodedSlash=true"
@@ -42,6 +44,8 @@ services:
       - "80:80"
       - "443:443"
       - "8080:8080"
+      - "2221:2221"
+      - "10171:10171"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - traefik_certs:/var/traefik/certs/:rw
diff --git a/boilerplates/traefik/dynamic/gitea.yml b/boilerplates/traefik/dynamic/gitea.yml
index 31fdc61..2850fb9 100644
--- a/boilerplates/traefik/dynamic/gitea.yml
+++ b/boilerplates/traefik/dynamic/gitea.yml
@@ -15,3 +15,17 @@ http:
       loadBalancer:
         servers:
           - url: "http://10.1.71.129:3000"
+
+tcp:
+  routers:
+    gitea-ssh:
+      rule: "HostSNI(`*`)"
+      entryPoints:
+        - gitea-ssh
+      service: gitea-ssh
+
+  services:
+    gitea-ssh:
+      loadBalancer:
+        servers:
+          - address: "10.1.71.129:2221"
diff --git a/boilerplates/traefik/dynamic/jarvis.yml b/boilerplates/traefik/dynamic/jarvis.yml
index 7694072..5d685cf 100644
--- a/boilerplates/traefik/dynamic/jarvis.yml
+++ b/boilerplates/traefik/dynamic/jarvis.yml
@@ -33,3 +33,17 @@ http:
       loadBalancer:
         servers:
           - url: "http://10.1.71.131:8642"
+
+tcp:
+  routers:
+    jarvis-ssh:
+      rule: "HostSNI(`*`)"
+      entryPoints:
+        - jarvis-ssh
+      service: jarvis-ssh
+
+  services:
+    jarvis-ssh:
+      loadBalancer:
+        servers:
+          - address: "10.1.71.131:22"