Prepare gated Gitea HTTPS and SSH cutover

ansible/roles/profile_server/templates/prometheus-backup-export.sh.j2

@@ -59,7 +59,7 @@ stack_stopped=true
 systemctl stop "$stack_unit"
 tar --acls --xattrs --selinux "${excludes[@]}" -C / -cf "$stage/payload.tar" "${paths[@]}"
 systemctl start "$stack_unit"
-for container in nginx-proxy-manager gitea; do
+for container in nginx-proxy-manager{% if not server_gitea_on_atlas | bool %} gitea{% endif %}; do
   running=false
   for _ in {1..30}; do
     if [[ $(podman inspect --format '{{ '{{.State.Running}}' }}' "$container" 2>/dev/null) == true ]]; then

ansible/roles/profile_server/templates/prometheus-gitea-ssh-proxy.service.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Forward public Gitea SSH to Atlas through Aegis
+Requires=prometheus-gitea-ssh-proxy.socket
+After=network-online.target wg-quick@wg0.service
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd {{ server_gitea_atlas_address }}:{{ server_gitea_ssh_target_port }}
+DynamicUser=true
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true

ansible/roles/profile_server/templates/prometheus-gitea-ssh-proxy.socket.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Public Gitea SSH socket on Prometheus
+
+[Socket]
+ListenStream=0.0.0.0:{{ server_gitea_ssh_public_port }}
+NoDelay=true
+
+[Install]
+WantedBy=sockets.target