s2i2s octavia: add a listener on port 22/tcp.

s2i2s/project-setup/acme-challenge.tf

@@ -0,0 +1,17 @@
+# DNS-01 ACME challenge delegation.
+# Let's Encrypt follows the CNAME, so the TXT records are published in the
+# isti.cnr.it zone instead of the one managed here.
+
+locals {
+  acme_challenge_recordset_name = "_acme-challenge.${local.dns_zone.name}"
+  acme_challenge_delegation     = "_acme-challenge.isti.cnr.it."
+}
+
+resource "openstack_dns_recordset_v2" "acme_challenge_recordset" {
+  zone_id     = local.dns_zone_id
+  name        = local.acme_challenge_recordset_name
+  description = "Delegation of the DNS-01 Let's Encrypt challenge to the isti.cnr.it zone"
+  ttl         = 8600
+  type        = "CNAME"
+  records     = [local.acme_challenge_delegation]
+}

s2i2s/project-setup/haproxy.tf

@@ -63,6 +63,20 @@ resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_443" {
   remote_ip_prefix  = "0.0.0.0/0"
 }
 
+# Git over SSH: the traffic arrives from the main load balancer, that keeps the
+# public port 22, and reaches HAPROXY on this port. Like 80 and 443, the source
+# is the real client address, so the rule cannot be restricted
+resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_git_ssh" {
+  security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
+  description       = "Git over SSH, through the OVN based main lb. The source is the client IP"
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = local.git_ssh_data.haproxy_bind_port
+  port_range_max    = local.git_ssh_data.haproxy_bind_port
+  remote_ip_prefix  = "0.0.0.0/0"
+}
+
 # HAPROXY stats, port 8880.
 # The OVN provider does not support allowed_cidrs on the listener, so this security
 # group is the only place where the stats can be restricted. Since OVN preserves the

s2i2s/project-setup/main.tf

@@ -64,6 +64,9 @@ locals {
   haproxy_l7_data        = module.project_variables.haproxy_l7_data
   prometheus_server_data = module.project_variables.prometheus_server_data
 
+  # Ports of the git over SSH path: main lb -> HAPROXY L7 -> forgejo
+  git_ssh_data = module.project_variables.git_ssh_data
+
   # Octavia LB settings for OVN driver
   octavia_lb_name        = module.project_variables.main_octavia_lb_name
   octavia_lb_description = module.project_variables.main_octavia_lb_description

s2i2s/project-setup/octavia.tf

@@ -180,3 +180,54 @@ resource "openstack_lb_monitor_v2" "main_haproxy_https_monitor" {
   max_retries    = 3
   admin_state_up = true
 }
+
+# Git over SSH.
+# Published here instead of putting a floating IP on the forgejo VM: the
+# listener keeps the public port 22, so the clone URLs need no port, and
+# forwards to the HAPROXY L7 instances, that cannot listen on 22 themselves
+# because sshd is there. See s2i2s/forgejo and the 'git_ssh' entry of
+# haproxy_l7_tcp_services in infrastructure-playbooks.
+resource "openstack_lb_listener_v2" "main_haproxy_git_ssh_listener" {
+  loadbalancer_id = openstack_lb_loadbalancer_v2.main_lb.id
+  protocol        = "TCP"
+  protocol_port   = local.git_ssh_data.public_port
+  description     = "SSH listener of the git service, forwarded to the HAPROXY L7 instances"
+  name            = "main_haproxy_git_ssh_listener"
+  admin_state_up  = true
+}
+
+resource "openstack_lb_pool_v2" "main_haproxy_git_ssh_pool" {
+  listener_id = openstack_lb_listener_v2.main_haproxy_git_ssh_listener.id
+  protocol    = "TCP"
+  lb_method   = "SOURCE_IP_PORT"
+  name        = "main-haproxy-lb-git-ssh"
+  description = "Pool for the SSH listener of the git service"
+  persistence {
+    type = "SOURCE_IP"
+  }
+  admin_state_up = true
+}
+
+resource "openstack_lb_members_v2" "main_haproxy_git_ssh_pool_members" {
+  pool_id = openstack_lb_pool_v2.main_haproxy_git_ssh_pool.id
+  member {
+    name          = "haproxy l7 1"
+    address       = local.basic_services_ip.haproxy_l7_1
+    protocol_port = local.git_ssh_data.haproxy_bind_port
+  }
+  member {
+    name          = "haproxy l7 2"
+    address       = local.basic_services_ip.haproxy_l7_2
+    protocol_port = local.git_ssh_data.haproxy_bind_port
+  }
+}
+
+resource "openstack_lb_monitor_v2" "main_haproxy_git_ssh_monitor" {
+  pool_id        = openstack_lb_pool_v2.main_haproxy_git_ssh_pool.id
+  name           = "main_haproxy_git_ssh_monitor"
+  type           = "TCP"
+  delay          = 20
+  timeout        = 5
+  max_retries    = 3
+  admin_state_up = true
+}