ansible-role-tcp-forward

Forwards TCP ports from this host to another one with redir, one systemd service per forward. Typical use: keep a service's non-HTTP port (e.g. Forgejo SSH) reachable at the same name as its HTTP side after the name moves to a reverse-proxy host.

What it does

1. Fails unless every tcp_forwards entry has name, listen_port, target_host and target_port.
2. Installs redir.
3. Templates /etc/systemd/system/tcp-forward-<name>.service per entry: redir -n :<listen_port> <target_host>:<target_port>, restarted on failure, running as a dynamic unprivileged user with only CAP_NET_BIND_SERVICE (so ports below 1024 work).
4. Enables and starts each service, restarting it when its unit changed, then waits for the port to listen.

Removing an entry does not remove its service; stop and delete tcp-forward-<name>.service by hand.

Variables

Variable	Default	Description
tcp_forwards	[]	{name, listen_port, target_host, target_port}

The forwarder listens on all addresses. The target sees connections coming from this host, not from the original client.

Example playbook

- hosts: all
  vars:
    tcp_forwards:
      - name: forgejo-ssh
        listen_port: 222
        target_host: 192.168.2.245
        target_port: 222
  roles:
    - tcp-forward