Gitea's SSH server is disabled (START_SSH_SERVER=false) so the SSH URL rewrite breaks git HTTPS clones in build containers. HTTPS git ops work directly from Legion host network — Cloudflare bypasses CF Access for smart-HTTP and release asset paths.