Since Nginx is presumably running in the same VM
I’ve got Gitea and nginx running in separate VM’s.
Gitea declares its HTTP port, but without a public service:
app = "my-gitea" ;
[[services]]
http_checks = []
internal_port = 3000
protocol = "tcp"
script_checks = []
nginx exposes a public 80/443:
app = "my-nginx"
[[services]]
internal_port = 8080
protocol = "tcp"
script_checks = []
[[services.ports]]
force_https = true
handlers = [ "http" ]
port = 80
[[services.ports]]
handlers = [ "tls", "http" ]
port = 443
and proxies HTTP traffic to Gitea over the internal network:
server {
listen 8080 ;
server_name my-nginx.fly.dev ;
location / {
proxy_pass http://my-gitea.internal:3000 ;
}
}
But the same technique doesn’t work for port 22 e.g. for Gitea:
[[services]]
internal_port = 22
protocol = "tcp"
and for nginx:
[[services]]
internal_port = 8022
protocol = "tcp"
[[services.ports]]
handlers = []
port = 8022
and:
upstream ssh_target {
server my-gitea.internal:22 ;
}
server {
listen 8022 ;
proxy_pass ssh_target ;
}
I can connect to Gitea over SSH on port 22 from inside the Gitea VM, but not from outside. It has to be because fly.io is using port 22 for itself. The only way I could get things to work was to create a service mapping Gitea’s port 22 to 3022, and have nginx proxy traffic to my-gitea.fly.dev:3022, but this also makes port 3022 accessible from the internet.
For Gitea, it looks like setting env var SSH_PORT=8022 can help you there.
That setting is used to control what gets shown in UI. Gitea can actually be configured to run its own SSH server, but I would need to build the Docker image from scratch (so that I can expose the custom port), instead of using the stock image from Docker Hub. That’s why I was hoping there was a simple way of remapping a port, like [[services.ports]], but for the internal network only.
Exposing the port on the open internet isn’t a security risk per se - anything a hacker could do on that port, they can do on the public port that nginx is proxying - but it’s kinda icky 
, and if I ever want to e.g. put access controls on the port (e.g. to block abusive IP’s), they could be bypassed by going to the Gitea port directly.
