fix forgejo crypto

common.nix

@@ -24,8 +24,14 @@
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
       PermitRootLogin = "no";
-      AllowUsers = [ "ellie" ];
+      AllowUsers = [ "ellie" "forgejo" ];
     };
+    extraConfig = ''
+      Match User forgejo Address 10.10.0.1
+        AllowTcpForwarding no
+        X11Forwarding no
+        PermitTunnel no
+    '';
   };
 
   services.fail2ban = {

services/forgejo.nix

@@ -8,7 +8,6 @@
 
   networking.firewall.interfaces.wg0.allowedTCPPorts = [
     3000
-    2222
   ];
 
   services.forgejo = {
@@ -20,10 +19,9 @@
       ROOT_URL = "https://forgejo.ellie.town/";
       HTTP_ADDR = "10.10.0.2";
       HTTP_PORT = 3000;
-      START_SSH_SERVER = true;
+      START_SSH_SERVER = false;
       SSH_DOMAIN = "forgejo.ellie.town";
       SSH_PORT = 2222;
-      SSH_LISTEN_PORT = 2222;
     };
   };
 }

services/wireguard-outer.nix

@@ -97,7 +97,7 @@
       }
 
       upstream forgejo_ssh {
-        server 10.10.0.2:2222;
+        server 10.10.0.2:22;
       }
       server {
         listen 2222;