feat(traefik): add TCP SSH entrypoints for Gitea (2221) and JARVIS (10171)

- New entrypoints: gitea-ssh/:2221, jarvis-ssh/:10171
- Expose both ports from the Traefik container
- gitea.yml: TCP passthrough router -> 10.1.71.129:2221
- jarvis.yml: TCP passthrough router -> 10.1.71.131:22
- Both use HostSNI(*) — dedicated entrypoints, no TLS wrapping needed
- UniFi to forward both ports to lightning-lane

boilerplates/traefik/compose.yaml

@@ -16,6 +16,8 @@ services:
       # Entrypoints
       - "--entrypoints.ping.address=:8082"
       - "--entrypoints.web.address=:80"
+      - "--entrypoints.gitea-ssh.address=:2221"
+      - "--entrypoints.jarvis-ssh.address=:10171"
       - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.encodedCharacters.allowEncodedSlash=true"
@@ -42,6 +44,8 @@ services:
       - "80:80"
       - "443:443"
       - "8080:8080"
+      - "2221:2221"
+      - "10171:10171"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - traefik_certs:/var/traefik/certs/:rw

boilerplates/traefik/dynamic/gitea.yml

@@ -15,3 +15,17 @@ http:
       loadBalancer:
         servers:
           - url: "http://10.1.71.129:3000"
+
+tcp:
+  routers:
+    gitea-ssh:
+      rule: "HostSNI(`*`)"
+      entryPoints:
+        - gitea-ssh
+      service: gitea-ssh
+
+  services:
+    gitea-ssh:
+      loadBalancer:
+        servers:
+          - address: "10.1.71.129:2221"

boilerplates/traefik/dynamic/jarvis.yml

@@ -33,3 +33,17 @@ http:
       loadBalancer:
         servers:
           - url: "http://10.1.71.131:8642"
+
+tcp:
+  routers:
+    jarvis-ssh:
+      rule: "HostSNI(`*`)"
+      entryPoints:
+        - jarvis-ssh
+      service: jarvis-ssh
+
+  services:
+    jarvis-ssh:
+      loadBalancer:
+        servers:
+          - address: "10.1.71.131:22"