esh-pfi-infrastructure/persistent-memory.d/2026-09-17-gitea-was-reaching-the-public-route-from-every-repo-on-nh3.md

[2026-09-17] gitea was reaching the PUBLIC route from every repo on nh3-dev

gitea was reaching the PUBLIC route from every repo on nh3-dev — brokkr-smithy, sleipnir, Galdrabok, kvasir — and brokkr-smithy is pushed several times a week, so the fail2ban trigger was live, not dormant. Measured before acting (no split-horizon rewrite, no ssh alias, ssh -G confirmed port 22 to 38.120.12.44). Fixed by overriding the NAME once in ~/.ssh/config rather than rewriting N remotes, so fresh clones and unaudited repos are covered too. Verified with a real git ls-remote, not by inspection. Commit dcc1abc. Flagged by brokkr-smithy-dev; vh/imogen created for them the same session.