title: How to clone gitlab repo over tor using ssh?
body: <h3>Error message</h3>
  <p>After having added the ssh key of a user of a GitLab server and repository that is hosted over tor, a test was performed that tried to clone a private repository (to which the testing user is added) over tor. The cloning was attempted with command:</p>
  <pre><code>torsocks git clone git@some_onion_domain.onion:root/test.git
  </code></pre>
  <p>Which returns error:</p>
  <blockquote>
  <p>Cloning into 'test'... 1620581859 ERROR torsocks[50856]: Connection
  refused to Tor SOCKS (in socks5_recv_connect_reply() at socks5.c:543)
  ssh: connect to host some_onion_domain.onion port 22: Connection
  refused fatal: Could not read from remote repository.</p>
  <p>Please make sure you have the correct access rights and the repository
  exists.</p>
  </blockquote>
  <h3>GitLab SSH Cloning Verification</h3>
  <p>However, to verify the ssh access is available to the test user, the cloning was verified without tor using command:</p>
  <pre><code>git clone git@127.0.0.1:root/test.git
  </code></pre>
  <p>Which successfully returned:</p>
  <blockquote>
  <p>Cloning into 'test'... remote: Enumerating objects: 3, done. remote:
  Counting objects: 100% (3/3), done. remote: Total 3 (delta 0), reused
  0 (delta 0), pack-reused 0 Receiving objects: 100% (3/3), done.</p>
  </blockquote>
  <h3>Server side hypothesis</h3>
  <ul>
  <li>My first guess is that it is a server-side issue that has to do with the lack of <code>https</code>, in following setting in the <code>/etc/gitlab/gitlab.rb</code> file:</li>
  </ul>
  <pre><code>external_url 'http://127.0.0.1'​
  </code></pre>
  <p>However setting <code>external_url 'https://127.0.0.1</code> requires an https certificate, e.g. from Let's encrypt, which seem to not be provided for onion domains.</p>
  <h3>Client-side hypothesis</h3>
  <ul>
  <li>My second guess would be that it is a client-side issue related to some <code>SOCKS</code> setting is incorrect at the test user side that runs the <code>torsocks</code> command, similar to an issue w.r.t. the <code>SOCKS 5</code> protocol that seems to be described <a href="https://tor.stackexchange.com/questions/4855/is-it-possible-to-have-a-hidden-git-service?rq=1">here</a>.</li>
  </ul>
  <h3>Question</h3>
  <p>Hence I would like to ask:</p>
  <p><em>How can I resolve the <code>connect to host some_onion_domain.onion port 22: Connection refused</code> error when users try to clone the repo over tor?</em></p>