From 87367d4387802b00d3268eb9f32980de744f6d5c Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Tue, 14 Apr 2026 23:53:18 -0500
Subject: [PATCH] Add Gitea SSH tunnel via ssh.git.neuralplatform.ai

---
 servers/legion/main.tf | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index a49784c..6456fb6 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -103,6 +103,21 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    # git.neuralplatform.ai — Gitea web UI (HTTP via Traefik)
+    ingress_rule {
+      hostname = "git.neuralplatform.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # ssh.git.neuralplatform.ai — Gitea SSH (direct to NodePort 30022)
+    ingress_rule {
+      hostname = "ssh.git.neuralplatform.ai"
+      service  = "ssh://localhost:30022"
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"