cluster/services/forge: use separate domain for ssh access

cluster/services/forge/default.nix

@@ -30,4 +30,8 @@
     address = "https://forge.${depot.lib.meta.domain}/api/v1/version";
     module = "https2xx";
   };
+
+  dns.records."ssh.forge".target = map
+    (node: depot.hours.${node}.interfaces.primary.addrPublic)
+    config.services.forge.nodes.server;
 }

cluster/services/forge/server.nix

@@ -51,6 +51,7 @@ in
         PROTOCOL = link.protocol;
         HTTP_ADDR = link.ipv4;
         HTTP_PORT = link.port;
+        SSH_DOMAIN = "ssh.${host}";
       };
       oauth2_client = {
         REGISTER_EMAIL_CONFIRM = false;
@@ -70,7 +71,6 @@ in
         MINIO_BUCKET = "forgejo";
         MINIO_USE_SSL = true;
         MINIO_BUCKET_LOOKUP = "path";
-        SERVE_DIRECT = true;
       };
       log."logger.xorm.MODE" = "";
       # enabling this will leak secrets to the log