SSH remote unreachable from LAN: git-ssh host resolves to internal container IP #1

New issue

Open

opened 2026-06-14 23:51:47 +00:00 by forgejo-admin · 0 comments

forgejo-admin commented

2026-06-14 23:51:47 +00:00

Owner

Summary

Cloning/pushing over SSH to this repo times out from the LAN. The SSH hostname resolves to an internal celilo container IP that isn't routable from outside the deployment network.

Details

git-ssh.git.celilo.computer → 10.0.20.14 (internal 10.x container IP — not routable from the LAN; TCP connect to port 2222 times out)
git.celilo.computer (web/HTTPS) → 192.168.0.253 (reachable; HTTPS returns 200, and git push over HTTPS works)

So the web host is fronted by a reachable reverse proxy on the LAN, but the SSH subdomain points straight at the internal container IP.

Current workaround

Use the HTTPS remote:

git remote set-url origin https://git.celilo.computer/celilo/lunacycle.git

(Auth via a Forgejo personal access token.)

Likely cause

Split-horizon DNS — the git-ssh record returns the internal IP rather than a LAN-reachable front door. Same class of problem as ISS-0101 (split-horizon www resolving to the natIp), tracked in e2e/tests/deploy.test.ts.

Acceptance criteria

SSH clone/push works from the LAN (DNS/routing fix), or
HTTPS is documented as the supported transport and SSH expectations are set in the README.

## Summary Cloning/pushing over SSH to this repo times out from the LAN. The SSH hostname resolves to an internal celilo container IP that isn't routable from outside the deployment network. ## Details - `git-ssh.git.celilo.computer` → `10.0.20.14` (internal `10.x` container IP — not routable from the LAN; TCP connect to port `2222` times out) - `git.celilo.computer` (web/HTTPS) → `192.168.0.253` (reachable; HTTPS returns 200, and `git push` over HTTPS works) So the web host is fronted by a reachable reverse proxy on the LAN, but the SSH subdomain points straight at the internal container IP. ## Current workaround Use the HTTPS remote: ``` git remote set-url origin https://git.celilo.computer/celilo/lunacycle.git ``` (Auth via a Forgejo personal access token.) ## Likely cause Split-horizon DNS — the `git-ssh` record returns the internal IP rather than a LAN-reachable front door. Same class of problem as **ISS-0101** (split-horizon `www` resolving to the natIp), tracked in `e2e/tests/deploy.test.ts`. ## Acceptance criteria - [ ] SSH clone/push works from the LAN (DNS/routing fix), **or** - [ ] HTTPS is documented as the supported transport and SSH expectations are set in the README.

forgejo-admin added the

type/bug

area/deploy

priority/high

labels

2026-06-14 23:51:47 +00:00