brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(network): add CADDY/IoT -> Forgejo git-over-SSH rules

Browse source 
Switched all internal hosts from HTTPS+token to SSH for git access to
Forgejo, using a shared deploy key. SSH bypasses Caddy (proxying raw
TCP isn't possible), so raspberrypi and Home Assistant each needed a
direct TRUSTED-zone rule to 10.0.10.18:2222.
This commit is contained in:
Brian Pooe 2026-07-19 15:00:08 +02:00
parent a7de8cec3a
commit 0ff2df7033
1 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
docs/network/allow-caddy-to-apps.md
View file

@ -99,7 +99,7 @@ Every policy in this table uses:
| `ALLOW CADDY to Bento PDF` | `10.0.10.6` | `8080` | Bento PDF | | `ALLOW CADDY to Bento PDF` | `10.0.10.6` | `8080` | Bento PDF |
| `ALLOW CADDY to Koffan` | `10.0.10.12` | `8080` | Koffan (LXC 111) | | `ALLOW CADDY to Koffan` | `10.0.10.12` | `8080` | Koffan (LXC 111) |
| `ALLOW CADDY to Hermes` | `10.0.10.19` | `9119` | Hermes Agent dashboard (LXC 113) | | `ALLOW CADDY to Hermes` | `10.0.10.19` | `9119` | Hermes Agent dashboard (LXC 113) |
| `ALLOW CADDY to Forgejo` | `10.0.10.18` | `3000` | Forgejo (LXC 114) | | `ALLOW CADDY to Forgejo` | `10.0.10.18` | `3000,2222` | Forgejo web UI (LXC 114) and git-over-SSH for hosts pulling from raspberrypi's zone |
--- ---
@ -152,6 +152,21 @@ allow it, and both were found misconfigured while wiring this up:**
sudo ufw allow from 10.0.30.0/24 to any port 80,443 proto tcp sudo ufw allow from 10.0.30.0/24 to any port 80,443 proto tcp
``` ```
## 3b. CADDY / IoT → Forgejo git-over-SSH (port 2222)
Both raspberrypi (CADDY zone) and Home Assistant (IoT zone) clone
`homelab-blueprint` over SSH directly against the Forgejo LXC
(`10.0.10.18:2222`), bypassing Caddy entirely — SSH can't be proxied
through Caddy (HTTP/S only), so this traffic goes straight to the TRUSTED
zone. `10.0.10.18` has no host-level firewall (`ufw` not installed,
`iptables INPUT` policy `ACCEPT`), so only the UniFi zone rule matters
here — no second enforcement layer to fight, unlike the Caddy host above.
| Policy name | Source zone | Source IP | Destination zone | Destination IP | Destination port(s) | Purpose |
|---|---|---|---|---|---|---|
| `ALLOW CADDY to Forgejo` (existing rule, port added) | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.18` | `3000,2222` | Forgejo web UI + git-over-SSH from raspberrypi |
| `Allow HA to Forgejo SSH` | `IoT` | `10.0.30.6` | `TRUSTED` | `10.0.10.18` | `2222` | git-over-SSH from homeassistant |
`ufw status` on that host is the fastest way to check which subnets can `ufw status` on that host is the fastest way to check which subnets can
already reach it before assuming a UniFi rule is the problem. already reach it before assuming a UniFi rule is the problem.