Allow ssh

README.md

@@ -27,6 +27,7 @@ cp .env.example .env
 Edit `.env` and set:
 - `SHARED_NETWORK_NAME` to the same network name used by your main stack
 - `GITEA_DOMAIN` to your git subdomain (for example `git.example.com`)
+- `GITEA_SSH_PORT` to the host SSH port for Git over SSH (default in this setup: `2222`)
 - Postgres credentials for a dedicated Gitea database/user
 
 ## 2) Create Postgres DB/User (on your existing DB)
@@ -90,8 +91,36 @@ docker compose logs -f gitea
 docker compose logs -f gitea-runner
 ```
 
+## 8) Git over SSH
+
+This stack exposes Gitea SSH as `${GITEA_SSH_PORT}` on the host (default `2222`).
+
+Clone example:
+
+```bash
+git clone ssh://git@<your-gitea-domain>:2222/<owner>/<repo>.git
+```
+
+Important:
+- Include `<owner>/<repo>.git` (for example `alice/my-api.git`).
+- `git@<domain>/<repo>.git` is not valid for Gitea SSH clone URLs.
+- If you use SCP-style syntax, include the owner and rely on `~/.ssh/config` for port:
+  - `git@<your-gitea-domain>:<owner>/<repo>.git`
+
+If you want to keep using `git@<your-gitea-domain>:<owner>/<repo>.git` without specifying a port in each command, add this to your local `~/.ssh/config`:
+
+```sshconfig
+Host <your-gitea-domain>
+  HostName <your-gitea-domain>
+  User git
+  Port 2222
+  IdentitiesOnly yes
+```
+
 ## Notes
 
 - This setup uses HTTPS via Traefik labels and Let's Encrypt from your existing stack.
-- Git over SSH is not enabled in this compose because your current Traefik config only exposes `:80` and `:443`. HTTPS clone/push works directly.
+- Git over SSH is enabled by direct Docker port mapping (`${GITEA_SSH_PORT}:22`) to avoid changing your Traefik base config.
+- Port `22` on the host is often already used by the server's SSH daemon. Keep `GITEA_SSH_PORT=2222` unless you intentionally move host SSH to another port.
 - Gitea Actions is enabled (`GITEA__actions__ENABLED=true`).
+- If you ever enabled Gitea's internal SSH server before, keep `GITEA__server__START_SSH_SERVER=false` to avoid restart loops from port conflicts.