How to setup a git ssh tunnel that works with git lfs?

Question

My work configuration is I have my work desktop, that I use a VPN on to connect to a private gitlab server. I also use this desktop to ssh into a remote server to do my work. On this desktop and the remote server, I have configured an SSH tunnel in this manner: how to configure system to use git via an ssh reverse tunnel / proxy? In order to be able to access my private gitlab server through a VPN tunnel on my work desktop. This configuration works to access my gitlab server when I am not using git lfs.

However, this configuration does not seem to support git lfs. I think I need to tunnel more ports somehow, but I am not sure how to change the.ssh/config file on the remote server to reference the right ports. For reference, here is the.ssh/config on my work desktop:

Host remoteServer
  HostName remoteServer
  User username
  RemoteForward 127.0.0.1:2222 gitlabServer:22

And here is the.ssh/config I use on the remoteServer:

HOST gitlabServer
   hostname localhost
   port 2222

How can I modify these files, or do something else entirely, to support git lfs through the ssh tunnel I use?

I tried adding additional RemoteForward lines on my work desktop and LocalForward lines on the remote server to forward additional ports, but could not get my git lfs commands to work.

Answer 1

Git LFS has two ways of connecting over SSH. The first and older technique is to connect over SSH for credentials and then to perform the actual upload and download operations over HTTPS. The newer, and much more poorly supported option, is to use a pure SSH connection, and I'm not aware of any major forges which support this.

Thus, in order to get your data over to the GitLab server, you'll need to also forward port 443 on the remote machine locally (or port 80 if you're using insecure plain HTTP).

There's also another requirement, because the GitLab server is designed to hand out URLs in the Git LFS protocol that point to the server itself. If you're re-routing the data, then you need to tell Git LFS to rewrite the URLs you're using. This requires running git config --global lfs.transfer.enablehrefrewrite true and using url.*.insteadOf (run git config --help for details) to rewrite the HTTP or HTTPS URL to the server into one using your forwarded location.

However, if you're using HTTPS, you must ensure that the certificate for the GitLab server also validates with the hostname or IP address that you're rewriting. Thus, if you want to rewrite it to https://127.0.0.1:4443 , then the GitLab server would need to have 127.0.0.1 in its certificate, which it almost certainly won't. Thus, this is only likely to actually work at all if you're using plain HTTP.