So trying here in hopes that I can figure this out. It's now been a month of my trying to get git working behind a reverse proxy running in AWS and I'm completely stuck.. A high level overview would be that I've got a git repository running on a VM that I can access locally via git@git.lan, I can have my router forward any port to Git and I can access git via git@[publicIP], but I cannot access the git server via domain (git@git.example.com). Any time I attempt to checkout, clone, or push it kicks back an error:
>git push -u origin master
kex_exchange_identification: Connection closed by remote host
Connection closed by 23.x.x.x port 22
fatal: Could not read from remote repository.
Basically, the git repo runs in a docker container on a VM. I've changed the ports around such that the container is bound to port 22 on the host, the host SSH is tied to a different port, and the home router is set to forward traffic from external port 8022 to the VM on port 22. Then I went to my proxy hosted on a AWS EC2 instance and again tweaked the ports such that the host was running SSH on a separate port so that SSH traffic can flow through port 22 on the EC2 instance. Basically everything flows through port 22, with exception to the route between my EC2 instance and my home server, which is connecting on port 8022.
Client -> AWS EC2:22 -> [Home IP]:8022 -> VM:22 -> Docker:22
I think this EC2 instance is my issue somehow. This machine is running a simple HAProxy setup to forward HTTP/HTTPS traffic based on domain. I tried to set up SSH forwarding through HA Proxy - but I'm discovering that apparently isn't really possible... Maybe my config could help someone imagine what I'm trying to solve here...
global
log 127.0.0.1 local0 notice
maxconn 2000
user haproxy
group haproxy
defaults
log global
mode http
option ssl-hello-chk
option dontlognull
retries 3
option redispatch
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend ssh
mode tcp
bind *:22
default_backend gitlab-ssh22
frontend mydomain.io-gitlab
bind *:80
acl docker-acl hdr_end(host) -i docker.mydomain.io
acl gitlab-acl hdr_end(host) -i gitlab.mydomain.io
acl test-acl hdr_end(host) -i test.mydomain.io
use_backend gitlab-bk80 if docker-acl
use_backend gitlab-bk80 if gitlab-acl
use_backend test-bk80 if test-acl
default_backend none-bk
frontend mydomain.io-gitlab-https
bind *:443 ssl alpn h2 strict-sni crt /etc/ssl/mydomain.io/mydomain.io.pem
stats uri /haproxy?stats
acl docker-acl hdr_end(host) -i docker.mydomain.io
acl gitlab-acl hdr_end(host) -i gitlab.mydomain.io
use_backend gitlab-bk443 if docker-acl
use_backend gitlab-bk443 if gitlab-acl
default_backend none-bk
# acl letsencrypt-acl path_beg /.well-known/acme-challenge/
# use_backend letsencrypt if letsencrypt-acl
frontend mydomain.io-docker
bind *:5000 ssl alpn h2 strict-sni crt /etc/ssl/mydomain.io/mydomain.io.pem
default_backend docker-bk5000
backend gitlab-ssh22
mode tcp
server gitlab22 24.x.x.x:8022 check
backend gitlab-bk80
server gitlab80 24.x.x.x:8080
backend gitlab-bk443
server gitlab443 24.x.x.x:8443 ssl verify none maxconn 1000
backend docker-bk5000
server docker5000 24.x.x.x:5000 ssl verify none maxconn 1000
backend test-bk80
server test 24.x.x.x:5001 maxconn 1000
I've also attempted to using routes, but I had the same issue here as well..
Does anyone have a working configuration or example of what I'm attempting to accomplish? It's the last thing missing in my gitlab setup and it's driving me bonkers.