From d917d1377d4d7619b8cf61d5066a26ce90fc9a7a Mon Sep 17 00:00:00 2001
From: David Perez <perezdap@gmail.com>
Date: Wed, 24 Jun 2026 14:18:06 -0500
Subject: [PATCH] feat(ssh): route GitHub SSH over port 443

Add an opt-out (Y/n, default yes) step to the identity setup that writes a
'Host github.com -> ssh.github.com:443' block to ~/.ssh/config, working around
networks that intermittently block or reset outbound SSH on port 22.

Idempotent: skips if a 'Host github.com' block already exists. Mirrored across
setup.ps1 and setup.sh with matching content-verification tests.
---
 setup.ps1                           | 32 +++++++++++++++++++++++++++++
 setup.sh                            | 31 ++++++++++++++++++++++++++++
 tests/Test-GitHubSSHOverHttps.ps1   | 20 ++++++++++++++++++
 tests/test_github_ssh_over_https.sh | 26 +++++++++++++++++++++++
 4 files changed, 109 insertions(+)
 create mode 100644 tests/Test-GitHubSSHOverHttps.ps1
 create mode 100644 tests/test_github_ssh_over_https.sh

diff --git a/setup.ps1 b/setup.ps1
index c2c53a3..882a126 100644
--- a/setup.ps1
+++ b/setup.ps1
@@ -147,6 +147,38 @@ function Set-GitIdentity {
             }
         }
     }
+
+    # --- Part 3: Route GitHub SSH over port 443 ---
+    $routeGh = Read-Host "Route GitHub SSH over port 443? Fixes intermittent port-22 timeouts on restrictive networks. (Y/n)"
+    if ($routeGh -notmatch "^[Nn]$") {
+        Set-GitHubSSHOverHttps
+    }
+}
+
+function Set-GitHubSSHOverHttps {
+    $sshDir = Join-Path $HOME ".ssh"
+    $configPath = Join-Path $sshDir "config"
+
+    if (-not (Test-Path $sshDir)) {
+        New-Item -ItemType Directory -Path $sshDir -Force | Out-Null
+    }
+
+    if ((Test-Path $configPath) -and (Select-String -Path $configPath -Pattern '^\s*Host\s+github\.com\b' -Quiet)) {
+        Log-Info "A 'Host github.com' block already exists in ~/.ssh/config — leaving it untouched."
+        return
+    }
+
+    $block = @"
+
+# Route GitHub SSH over port 443 (port 22 is blocked/reset on some networks).
+# ssh.github.com:443 is GitHub's official SSH-over-HTTPS endpoint.
+Host github.com
+    Hostname ssh.github.com
+    Port 443
+    User git
+"@
+    Add-Content -Path $configPath -Value $block
+    Log-Success "Configured GitHub SSH to use port 443 in ~/.ssh/config"
 }
 
 function Set-SSHKeys {
diff --git a/setup.sh b/setup.sh
index 379d8e8..238e1d5 100644
--- a/setup.sh
+++ b/setup.sh
@@ -154,6 +154,37 @@ configure_identity() {
                 ;;
         esac
     fi
+
+    # --- Part 3: Route GitHub SSH over port 443 ---
+    echo -n "Route GitHub SSH over port 443? Fixes intermittent port-22 timeouts on restrictive networks. (Y/n): "
+    read route_gh
+    if [[ ! "$route_gh" =~ ^[Nn]$ ]]; then
+        configure_github_ssh_over_https
+    fi
+}
+
+configure_github_ssh_over_https() {
+    local ssh_dir="$HOME/.ssh"
+    local config_path="$ssh_dir/config"
+
+    mkdir -p "$ssh_dir"
+
+    if [ -f "$config_path" ] && grep -qE '^[[:space:]]*Host[[:space:]]+github\.com\b' "$config_path"; then
+        log_info "A 'Host github.com' block already exists in ~/.ssh/config — leaving it untouched."
+        return
+    fi
+
+    cat >> "$config_path" <<'EOF'
+
+# Route GitHub SSH over port 443 (port 22 is blocked/reset on some networks).
+# ssh.github.com:443 is GitHub's official SSH-over-HTTPS endpoint.
+Host github.com
+    Hostname ssh.github.com
+    Port 443
+    User git
+EOF
+    chmod 600 "$config_path" 2>/dev/null || true
+    log_success "Configured GitHub SSH to use port 443 in ~/.ssh/config"
 }
 
 setup_ssh() {
diff --git a/tests/Test-GitHubSSHOverHttps.ps1 b/tests/Test-GitHubSSHOverHttps.ps1
new file mode 100644
index 0000000..6134272
--- /dev/null
+++ b/tests/Test-GitHubSSHOverHttps.ps1
@@ -0,0 +1,20 @@
+Write-Host "Running content verification for GitHub SSH-over-443 in setup.ps1..."
+
+$content = Get-Content "./setup.ps1" -Raw
+
+$checks = @(
+    "function Set-GitHubSSHOverHttps",
+    "Route GitHub SSH over port 443?",
+    "Hostname ssh.github.com",
+    "Port 443",
+    "Host github.com"
+)
+
+foreach ($check in $checks) {
+    if ($content -notmatch [regex]::Escape($check)) {
+        Write-Error "FAIL: Expected string '$check' not found in setup.ps1"
+        exit 1
+    }
+}
+
+Write-Host "PASS: setup.ps1 contains GitHub SSH-over-443 logic"
diff --git a/tests/test_github_ssh_over_https.sh b/tests/test_github_ssh_over_https.sh
new file mode 100644
index 0000000..bb61cfa
--- /dev/null
+++ b/tests/test_github_ssh_over_https.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Content verification for GitHub SSH-over-443 in setup.sh
+
+echo "Running content verification for GitHub SSH-over-443 in setup.sh..."
+
+if [ ! -f "./setup.sh" ]; then
+    echo "FAIL: setup.sh not found"
+    exit 1
+fi
+
+checks=(
+    "configure_github_ssh_over_https()"
+    "Route GitHub SSH over port 443?"
+    "Hostname ssh.github.com"
+    "Port 443"
+    "Host github.com"
+)
+
+for check in "${checks[@]}"; do
+    if ! grep -qF "$check" ./setup.sh; then
+        echo "FAIL: Expected string '$check' not found in setup.sh"
+        exit 1
+    fi
+done
+
+echo "PASS: setup.sh contains GitHub SSH-over-443 logic"