From 6e58e573629f46689dc33a18ad9306c075cd5144 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 13 Jun 2026 17:04:36 -0700 Subject: [PATCH] docs(orientation): gitea internal-route gotcha (fleet hosts -> 10.250.50.70:222) Fleet/colo hosts must reach gitea over the internal route (ana-docker container git-SSH at 10.250.50.70:222), not the public gitea.phasefinal.com:22 which fail2bans the host's egress IP and silently wedges webhook auto-deploys. Bit irv-ml1's arbo deploy 2026-06-13. --- docs/orientation.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/orientation.md b/docs/orientation.md index 66dd5cf..bfc1fa3 100644 --- a/docs/orientation.md +++ b/docs/orientation.md @@ -164,6 +164,25 @@ These caught us once; don't let them catch you twice. - **irv-ml1 was `ana-ml1`** before a physical move; OS hostname still says `ana-ml1` pending an explicit rename. Doesn't affect services. +### Git / gitea + +- **Colo/fleet hosts must reach gitea over the INTERNAL route, not the + public IP.** `gitea.phasefinal.com` resolves to the **public** IP + `38.120.12.44` (ana-srv1); gitea itself is a container on **ana-docker** + with git-SSH at **`10.250.50.70:222`** (`222→22`) and HTTP at `:3000`. + A fleet host that egresses to the public `:22` gets its egress IP + **fail2ban-banned** after any retrying git/deploy loop, which silently + wedges automation — e.g. a gitea-webhook auto-deploy whose `git fetch` + then times out under `set -euo pipefail` and never reaches the `reset`. + Point each host's gitea ssh alias at `HostName 10.250.50.70` / + `Port 222` with the repo deploy key; the internal route is ban-immune + and treats the cause. Bit irv-ml1's arbo deploy on 2026-06-13 (the + `gitea-arbo` alias pointed at the public host → fetch timeout → the + v0.11.7 frontend wouldn't serve until the alias was repointed internal). +- **`:22` on `10.250.50.70` is ana-docker's HOST sshd, not gitea.** A + gitea deploy key there returns `Permission denied (publickey)` — gitea's + git-SSH is the container port `:222`. (HTTP/clone-over-HTTPS is `:3000`.) + ### Workflow - **Terminal word-wrap breaks long pasted commands.** Never embed a