initial

nginx-seeds/rssh-bastion-stream.conf.example

@@ -0,0 +1,20 @@
+# FE nginx stream — TCP proxy to BE sshd for RSSH bastion (ra.apps.f0xx.org:443).
+# Install on FE (Gentoo); BE runs openssh with Match User ra-* (see sshd_config.d/ra.conf).
+#
+# *** DO NOT install under BE /etc/nginx/stream.d/ ***
+# BE already uses listen 443 ssl in conf.d/apps.conf (http). Stream listen 443 here
+# causes: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address in use)
+#
+# Include from nginx.conf:
+#   include /etc/nginx/stream.d/rssh-bastion.conf;
+
+upstream rssh_bastion_be {
+    server 10.7.16.128:22;  # artc0 / alpine-be — adjust for cluster/lab
+}
+
+server {
+    listen 443;
+    proxy_pass rssh_bastion_be;
+    proxy_connect_timeout 30s;
+    proxy_timeout 24h;
+}