From a83380f64cfd17da3e9608c49e09d8d6dc09b248 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Thu, 18 Jun 2026 16:14:02 -0700
Subject: [PATCH] proxies / staging: move ssh to port 222

This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.

We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.

Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
---
 .../host_vars/proxy01.stg.rdu3.fedoraproject.org     |  1 +
 .../host_vars/proxy02.stg.rdu3.fedoraproject.org     |  1 +
 inventory/inventory                                  | 12 ++++++------
 roles/base/templates/nftables/_nft_accept_ssh        |  2 +-
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/inventory/host_vars/proxy01.stg.rdu3.fedoraproject.org b/inventory/host_vars/proxy01.stg.rdu3.fedoraproject.org
index ea3e0f25c4..65374b06e8 100644
--- a/inventory/host_vars/proxy01.stg.rdu3.fedoraproject.org
+++ b/inventory/host_vars/proxy01.stg.rdu3.fedoraproject.org
@@ -35,6 +35,7 @@ nrpe_procs_crit: 1400
 nrpe_procs_warn: 1200
 # This is consumed by the roles/fedora-web/main role
 sponsor: redhat
+sshd_port: 222
 vmhost: vmhost-x86-02.stg.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
 vpn: false
diff --git a/inventory/host_vars/proxy02.stg.rdu3.fedoraproject.org b/inventory/host_vars/proxy02.stg.rdu3.fedoraproject.org
index 8804380b78..4045239608 100644
--- a/inventory/host_vars/proxy02.stg.rdu3.fedoraproject.org
+++ b/inventory/host_vars/proxy02.stg.rdu3.fedoraproject.org
@@ -35,6 +35,7 @@ nrpe_procs_crit: 1400
 nrpe_procs_warn: 1200
 # This is consumed by the roles/fedora-web/main role
 sponsor: redhat
+sshd_port: 222
 vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
 vpn: false
diff --git a/inventory/inventory b/inventory/inventory
index 6b55a3661b..5069f7c175 100644
--- a/inventory/inventory
+++ b/inventory/inventory
@@ -543,12 +543,12 @@ proxies_external
 proxies_internal
 
 [proxies_stg]
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 
 [proxies_stg_rdu3]
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 
 [relvalconsumer_common]
 openqa01.rdu3.fedoraproject.org
@@ -645,8 +645,8 @@ mailman01.stg.rdu3.fedoraproject.org
 memcached01.stg.rdu3.fedoraproject.org
 os-control01.stg.rdu3.fedoraproject.org
 pkgs01.stg.rdu3.fedoraproject.org
-proxy01.stg.rdu3.fedoraproject.org
-proxy02.stg.rdu3.fedoraproject.org
+proxy01.stg.rdu3.fedoraproject.org ansible_port=222
+proxy02.stg.rdu3.fedoraproject.org ansible_port=222
 rabbitmq01.stg.rdu3.fedoraproject.org
 rabbitmq02.stg.rdu3.fedoraproject.org
 rabbitmq03.stg.rdu3.fedoraproject.org
diff --git a/roles/base/templates/nftables/_nft_accept_ssh b/roles/base/templates/nftables/_nft_accept_ssh
index 24f0093058..a11d1c43af 100644
--- a/roles/base/templates/nftables/_nft_accept_ssh
+++ b/roles/base/templates/nftables/_nft_accept_ssh
@@ -2,5 +2,5 @@
 # Accept ssh
 
 # allow ssh - always
-add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept
+add rule {{_tn}} INPUT ct state new tcp dport {{sshd_port}} counter accept