diff --git a/argocd/apps/traefik.yaml b/argocd/apps/traefik.yaml
index 01ea54a..77e64cf 100644
--- a/argocd/apps/traefik.yaml
+++ b/argocd/apps/traefik.yaml
@@ -30,6 +30,7 @@ spec:
           - "--ping=true"
           - "--metrics.prometheus=true"
           - "--metrics.prometheus.entrypoint=metrics"
+          - "--entryPoints.ssh.address=:2222/tcp"
           - "--providers.kubernetesingress.ingressclass=traefik"
           - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik"
           - "--accesslog=true"
@@ -48,6 +49,10 @@ spec:
           websecure:
             port: 8443
             exposedPort: 443
+          ssh:
+            port: 2222
+            exposedPort: 22
+            protocol: TCP
           metrics:
             port: 9100
             expose:
diff --git a/manifests/gitea/ingressroute-ssh.yaml b/manifests/gitea/ingressroute-ssh.yaml
new file mode 100644
index 0000000..01bcb9f
--- /dev/null
+++ b/manifests/gitea/ingressroute-ssh.yaml
@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: gitea
+          port: 22