Enable TCP forwarding on the headnode exclusively for 127.0.0.1:2222

The sshd that the systemd-nspawn container for the HTCondor migration runs listens on 127.0.0.1:2222 (on the headnode).

Ansible's ProxyCommand setting, specified in the Ansible inventory file (hosts), requires TCP forwarding to work.

This PR enables TCP forwarding, but only local forwarding and exclusively to the container's sshd port.

In addition, the changes are tied to the `central-manager-secondary-host.yml` group vars file and to the `central-manager-secondary-host` group from the Ansible inventory, so that when the migration is complete and the container is removed, the setting no longer applies.

For more information, see https://manpages.debian.org/bookworm/openssh-server/sshd_config.5.en.html#PermitOpen and https://manpages.debian.org/bookworm/openssh-server/sshd_config.5.en.html#AllowTcpForwarding.

group_vars/central-manager-secondary-host.yml

@@ -60,3 +60,7 @@ nspawn_ssh_host_certs:
 nspawn_ssh_authorized_keys:
   - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDV7gfNbNN5O8vH6/tM/iOFXKBP2YKRHXOmdfV8ogvu9BdVV0IPmDzk2EooVpThDE1VMv1hz3811tvBhHRJ6IgNhVIV/61w/+RazQD/AU27X8bX+Hb9EQ/bP4DW+6ySd/z5vdDLzpH5dbiMhzPEDkXVsylUT+hkQnas6cHspDhHmtKQ5MWOgDe3D/IEudTDJQe8hxxaU4TaZUmFzn7eYp9HvuK8qW0yCy4NWOxJJHA+G5wSCyLuKnaKo4AitUIzSKF1AB94oq7b96KONhPxgRptAk4OYIUTdNFbrI5HDaSNzHLnF5FbjQvG+Eu6m5nY5yvJMogE+jiuWeIXCZTCFljg287FUo0ohmbZpd802L6VXun14VumRC+rRgPrvBALo/CsyCsPIoBSTKhVElxKVOcRjmTLNfrUZM0GQxqJhIvah8BV+JTExkipPwkrKTdMAWIXvCoehxV+WMpBWqtEEzAzEoqJpaiec7HfriwsHTGESZWAPYEbFjzbHXQZtqBkbOvtokPMRmTWfWKxaplCMN6ddJeeY6faorD0w/e6lszWES1Q1ieajiPKDy37UvybKKvPTk4o3MzyzYOS4c8HQj+jnGeR5Q3ETuyz4psLyOfuBtIrfOeuxV42rFDmkYM3IrrRR+F9oklFG6Ig8DVfgQEzSG36NkgvpF4OdFvigYqXvw== cloud@vgcn"
 nspawn_ssh_host_trust_container: yes
+
+ssh_allow_tcp_forwarding: "local"
+sshd_custom_options:
+  - "PermitOpen 127.0.0.1:{{ nspawn_ssh_config.Port }}"

hosts

@@ -84,3 +84,6 @@ manager-secondary.galaxyproject.eu ansible_host=127.0.0.1 ansible_port=2222 ansi
 
 [central-manager-secondary-host]
 sn06.galaxyproject.eu ansible_ssh_user=root
+
+[central-manager-secondary-host:vars]
+ansible_group_priority=2