proxies / staging: move ssh to port 222

This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.

We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.

Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

inventory/host_vars/proxy01.stg.rdu3.fedoraproject.org

@@ -35,6 +35,7 @@ nrpe_procs_crit: 1400
 nrpe_procs_warn: 1200
 # This is consumed by the roles/fedora-web/main role
 sponsor: redhat
+sshd_port: 222
 vmhost: vmhost-x86-02.stg.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
 vpn: false

inventory/host_vars/proxy02.stg.rdu3.fedoraproject.org

@@ -35,6 +35,7 @@ nrpe_procs_crit: 1400
 nrpe_procs_warn: 1200
 # This is consumed by the roles/fedora-web/main role
 sponsor: redhat
+sshd_port: 222
 vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
 vpn: false

inventory/inventory

@@ -543,12 +543,12 @@ proxies_external
 proxies_internal
 
 [proxies_stg]
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 
 [proxies_stg_rdu3]
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 
 [relvalconsumer_common]
 openqa01.rdu3.fedoraproject.org
@@ -645,8 +645,8 @@ mailman01.stg.rdu3.fedoraproject.org
 memcached01.stg.rdu3.fedoraproject.org
 os-control01.stg.rdu3.fedoraproject.org
 pkgs01.stg.rdu3.fedoraproject.org
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 rabbitmq01.stg.rdu3.fedoraproject.org
 rabbitmq02.stg.rdu3.fedoraproject.org
 rabbitmq03.stg.rdu3.fedoraproject.org

roles/base/templates/nftables/_nft_accept_ssh

@@ -2,5 +2,5 @@
 # Accept ssh
 
 # allow ssh - always
-add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept
+add rule {{_tn}} INPUT ct state new tcp dport {{sshd_port}} counter accept