exposing ssh port over traefik

[norganos]

Hi all!
I have a Gitea instance running and want to expose SSH Port 22 under the same IP (from the load balancer) as HTTPs.
My current approach is to patch Traefik to create a new endpoint and to create a IngressRouteTCP pointing to the gitea-ssh service.
That way the Hetzner load balancer correctly opens port 22 and points it to a port in the Traefik load balancer service.
However, ssh is not working, because gitea receives the ProxyProtocol intro (if I manually remove the Hetzner load balancer "proxy protocol" setting, it works)
Does anyone of you have an idea, how I could achieve my goal? can I disable Proxy Protocol for one service via the annotations in traefik service? Or can I configure the IngressRouteTCP or the underlying service so that the ProxyProtocol intro gets consumed?
Thanks for your support

[norganos]

Fresh update: looks like I was able to achieve my goal... bear in mind, I've just got it running, so it's just a proof of concept!

1: add port 22 endpoint to traefik helm chart

added the following to the HelmChartConfig kube-system/traefik (omitting the irrelevant parts):

spec:
  valuesContent:
    ports:
      ssh:
        port: 22
        expose: true

2: create resources for a new nginx deployment acting as a man-in-the-middle whose only job is to consume the proxy protocol header:

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: gitea
  name: gitea-ssh-adapter-config
data:
  startup.sh: |-
    #!/bin/sh
    backup="$UPSTREAM"
    export UPSTREAM="$(echo "$UPSTREAM" | envsubst)"
    if [ "$UPSTREAM" != "$backup" ]; then
      echo "expanded UPSTREAM from '$backup' to '$UPSTREAM'"
    fi
    defined_host="$(echo "$UPSTREAM" | sed -e 's/[^/]*\/\/\([^@]*@\)\?\([^:/]*\).*/\2/')"
    resolved_host="$(nslookup "$UPSTREAM" | grep "Name:" | sed -e 's/^Name:[ \t\]*//g')"
    if [ -n "$resolved_host" ] && [ "$defined_host" != "$resolved_host" ]; then
      echo "resolved hostname $defined_host to $resolved_host"
      export UPSTREAM="$(echo "$UPSTREAM" | sed "s/$defined_host/$resolved_host/")"
      echo "UPSTREAM now is '$UPSTREAM'"
    fi
    envsubst '$UPSTREAM' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
    nginx -g "daemon off;"
  nginx.conf.template: |-
    worker_processes  1;
    error_log  /tmp/error.log;
    pid        /tmp/nginx.pid;
    worker_rlimit_nofile 8192;
    events {
      worker_connections  128;
    }
    stream {
      upstream ssh_servers {
        least_conn;
        server $UPSTREAM:22;
      }
      server {
        listen 22 proxy_protocol;
        proxy_pass ssh_servers;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: gitea
  name: gitea-ssh-adapter
  labels:
    app: gitea-ssh-adapter
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-ssh-adapter
  template:
    metadata:
      labels:
        app: gitea-ssh-adapter
    spec:
      containers:
        - image: nginx:1.23-alpine
          name: nginx
          imagePullPolicy: Always
          ports:
            - containerPort: 22
          securityContext:
            readOnlyRootFilesystem: false
          env:
            - name: UPSTREAM
              value: gitea-ssh
          volumeMounts:
            - mountPath: /tmp
              name: tmp
            - mountPath: /opt/startup.sh
              name: config
              subPath: startup.sh
            - mountPath: /etc/nginx/nginx.conf.template
              name: config
              subPath: nginx.conf.template
          command: ['/bin/sh', '-c', '/opt/startup.sh']
      volumes:
        - name: config
          configMap:
            defaultMode: 0755
            name: gitea-ssh-adapter-config
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  namespace: gitea
  name: gitea-ssh-adapter
spec:
  selector:
    app: gitea-ssh-adapter
  ports:
    - port: 22
  type: ClusterIP
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  namespace: gitea
  name: gitea-ssh-adapter
spec:
  entryPoints:
    - ssh
  routes:
    - match: HostSNI(`*`)
      services:
        - name: gitea-ssh-adapter
          port: 22

I created a ConfigMap for easy nginx configuration updates. and the nginx.conf needs to able to resolve the gitea-ssh (from the gitea helm chart) service, but the short name 'gitea-ssh' does not work directly, so I used the alpine image of nginx (because it contains nslookup out of the box) and used that to acquire the fqdn of the service.