How do you configure HTTPS with Docker and nginx reverse-proxy? #5425

New Issue

GiteaMirror · 2025-11-02T06:24:35-06:00

GiteaMirror commented

2025-11-02 06:24:35 -06:00

Originally created by @Doko-Demo-Doa on GitHub (May 19, 2020).

Hello, I would like to use Gitea with Docker and HTTPS (use nginx as reverse proxy). I'm hosting Gitea on Google Cloud.

This is (part of) my app.ini:

[server]
APP_DATA_PATH    = /data/gitea
DOMAIN           = localhost
SSH_DOMAIN       = localhost
HTTP_PORT        = 3000
ROOT_URL         =
DISABLE_SSH      = false
SSH_PORT         = 22
SSH_LISTEN_PORT  = 22
LFS_START_SERVER = false
LFS_CONTENT_PATH = /data/git/lfs
PROTOCOL         = https

And this is my server blocks (in http block) in /etc/nginx/nginx.conf:

        server {
            listen 80;
            listen [::]:80;
            server_name git.acaziasoft.com;

            location / {
                proxy_pass http://127.0.0.1:3000;
            }
        }
        server {
            listen 443 ssl;
            listen [::]:443 ssl;
            server_name git.acaziasoft.com;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem;
            location / {
                proxy_pass http://unix:/var/run/gitea/gitea.sock;
            }
            access_log /var/log/nginx/gitea-proxy_access.log;
            error_log /var/log/nginx/gitea-proxy_error.log;
        }

In app.ini, if I change:

PROTOCOL         = https

to

PROTOCOL         = http

It works well and the site can be accessed (in http of course). But if I set it as PROTOCOL = https then I always get 502 Bad Gateway error.

What could be wrong?

Originally created by @Doko-Demo-Doa on GitHub (May 19, 2020). Hello, I would like to use Gitea with Docker and HTTPS (use nginx as reverse proxy). I'm hosting Gitea on Google Cloud. This is (part of) my `app.ini`: ```ini [server] APP_DATA_PATH = /data/gitea DOMAIN = localhost SSH_DOMAIN = localhost HTTP_PORT = 3000 ROOT_URL = DISABLE_SSH = false SSH_PORT = 22 SSH_LISTEN_PORT = 22 LFS_START_SERVER = false LFS_CONTENT_PATH = /data/git/lfs PROTOCOL = https ``` And this is my `server` blocks (in `http` block) in `/etc/nginx/nginx.conf`: ``` server { listen 80; listen [::]:80; server_name git.acaziasoft.com; location / { proxy_pass http://127.0.0.1:3000; } } server { listen 443 ssl; listen [::]:443 ssl; server_name git.acaziasoft.com; ssl on; ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem; location / { proxy_pass http://unix:/var/run/gitea/gitea.sock; } access_log /var/log/nginx/gitea-proxy_access.log; error_log /var/log/nginx/gitea-proxy_error.log; } ``` In `app.ini`, if I change: ``` PROTOCOL = https ``` to ``` PROTOCOL = http ``` It works well and the site can be accessed (in `http` of course). But if I set it as `PROTOCOL = https` then I always get `502 Bad Gateway` error. What could be wrong?

GiteaMirror closed this issue

2025-11-02 06:24:35 -06:00

GiteaMirror commented

2025-11-02 06:24:36 -06:00

@bryanpedini commented on GitHub (May 19, 2020):

I believe if you configure HTTPS in app.ini you also have to configure the SSL certificates and the correct URI for Gitea.
I think SSL certificates inside a Docker container, unless it's a shared Docker hosting like AWS or a completely different host than the one that gets the DNS hostname, it's pretty useless...

Best thing to do IMO would be to host the Gitea container inside the same machine that hosts the proxy_pass webserver, and configure HTTPS only on Nginx.
Also, I see you do not redirect HTTP to HTTPS inside your Nginx configs; and also you configured the HTTP (port 80) server config to proxy the port 3000 on localhost, and the HTTPS block (port 443) to proxy for Gitea socket file (have you shared the socket file between the host and the container or what?).

I do not personally host Gitea inside a Docker container (as of now, planning to migrate), but I configured Gitea in plain HTTP on 127.0.0.1:8001 and SSL only on Nginx that redirects HTTP to HTTPS and HTTPS proxies to 127.0.0.1:8001.

@bryanpedini commented on GitHub (May 19, 2020): I believe if you configure HTTPS in `app.ini` you also have to configure the SSL certificates and the correct URI for Gitea. I think SSL certificates inside a Docker container, unless it's a shared Docker hosting like AWS or a completely different host than the one that gets the DNS hostname, it's pretty useless... Best thing to do IMO would be to host the Gitea container inside the same machine that hosts the proxy_pass webserver, and configure HTTPS only on Nginx. Also, I see you do not redirect HTTP to HTTPS inside your Nginx configs; and also you configured the HTTP (port 80) server config to proxy the port 3000 on localhost, and the HTTPS block (port 443) to proxy for Gitea socket file (have you shared the socket file between the host and the container or what?). I do not personally host Gitea inside a Docker container (as of now, planning to migrate), but I configured Gitea in plain HTTP on `127.0.0.1:8001` and SSL only on Nginx that redirects HTTP to HTTPS and HTTPS proxies to `127.0.0.1:8001`.

GiteaMirror commented

2025-11-02 06:24:36 -06:00

@Doko-Demo-Doa commented on GitHub (May 19, 2020):

Thank you @bryanpedini yes you were right, HTTPS only needs to be configured on nginx side.

It is now working as expected. I had to add extra port mapping to docker-compose.yml:

services:
  server:
    image: gitea/gitea:latest
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - DB_TYPE=postgres
      - DB_HOST=db:5432
      - DB_NAME=gitea
      - DB_USER=gitea
      - DB_PASSWD=gitea
    restart: always
    networks:
      - gitea
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "22:22"
      - "5432:5432" # This one
    depends_on:
      - db

And the [server] block in app.ini. Since my Gitea is hosted on Google Cloud, it has two IP: Internal and External.

[server]
APP_DATA_PATH    = /data/gitea
DOMAIN           = localhost
SSH_DOMAIN       = localhost
HTTP_PORT        = 3000
ROOT_URL         = http://<Internal_IP>:3000/ # This is the network's internal IP
DISABLE_SSH      = false
SSH_PORT         = 22
SSH_LISTEN_PORT  = 22
LFS_START_SERVER = false
LFS_CONTENT_PATH = /data/git/lfs
PROTOCOL         = http

And the two server blocks in nginx.conf:

        server {
            listen 80;
            listen [::]:80;
            server_name git.acaziasoft.com;

            location / {
                proxy_pass http://127.0.0.1:3000;
            }
        }
        server {
            listen 443 ssl;
            listen [::]:443 ssl;
            server_name git.acaziasoft.com;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem;
            location / {
                proxy_pass http://127.0.0.1:3000; # This just simply points to localhost :D
            }
            access_log /var/log/nginx/gitea-proxy_access.log;
            error_log /var/log/nginx/gitea-proxy_error.log;
        }

With that, the site is up and running.

@Doko-Demo-Doa commented on GitHub (May 19, 2020): Thank you @bryanpedini yes you were right, HTTPS only needs to be configured on nginx side. It is now working as expected. I had to add extra port mapping to `docker-compose.yml`: ``` services: server: image: gitea/gitea:latest environment: - USER_UID=1000 - USER_GID=1000 - DB_TYPE=postgres - DB_HOST=db:5432 - DB_NAME=gitea - DB_USER=gitea - DB_PASSWD=gitea restart: always networks: - gitea volumes: - ./gitea:/data - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro ports: - "3000:3000" - "22:22" - "5432:5432" # This one depends_on: - db ``` And the `[server]` block in `app.ini`. Since my Gitea is hosted on Google Cloud, it has two IP: Internal and External. ```ini [server] APP_DATA_PATH = /data/gitea DOMAIN = localhost SSH_DOMAIN = localhost HTTP_PORT = 3000 ROOT_URL = http://<Internal_IP>:3000/ # This is the network's internal IP DISABLE_SSH = false SSH_PORT = 22 SSH_LISTEN_PORT = 22 LFS_START_SERVER = false LFS_CONTENT_PATH = /data/git/lfs PROTOCOL = http ``` And the two `server` blocks in `nginx.conf`: ``` server { listen 80; listen [::]:80; server_name git.acaziasoft.com; location / { proxy_pass http://127.0.0.1:3000; } } server { listen 443 ssl; listen [::]:443 ssl; server_name git.acaziasoft.com; ssl on; ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem; location / { proxy_pass http://127.0.0.1:3000; # This just simply points to localhost :D } access_log /var/log/nginx/gitea-proxy_access.log; error_log /var/log/nginx/gitea-proxy_error.log; } ``` With that, the site is up and running.

GiteaMirror commented

2025-11-02 06:24:36 -06:00

@bryanpedini commented on GitHub (May 19, 2020):

It is now working as expected. I had to add extra port mapping to docker-compose.yml:
    ports:
      - "3000:3000"
      - "22:22"
      - "5432:5432" # This one

Well, if you configured your DBMS (Postgres, in this case) on the host machine, yes, you have to forward the port (all tho I don't think that's the way to do it, since Docker probably throws an error for an already bound port on the host).
Why then having Gitea inside a Docker container then if you Docker-ize only Gitea and not Postgres too (I mean, there could be reasons, but I currently don't see 'em, okay it's 10am here in Italy and I'm still half asleep, but I still don't see 'em...)

And the [server] block in app.ini. Since my Gitlab is hosted on Google Cloud, it has two IP: Internal and External.

GitLab!?!?

And the two server blocks in nginx.conf:

        server {
            listen 80;
            listen [::]:80;
            server_name git.acaziasoft.com;

            location / {
                proxy_pass http://127.0.0.1:3000;
            }
        }
        server {
            listen 443 ssl;
            listen [::]:443 ssl;
            server_name git.acaziasoft.com;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem;
            location / {
                proxy_pass http://127.0.0.1:3000; # This just simply points to localhost :D
            }
            access_log /var/log/nginx/gitea-proxy_access.log;
            error_log /var/log/nginx/gitea-proxy_error.log;
        }

Why didn't you redirected HTTP to HTTPS as I suggested? Is there a particular reason why you (seemingly intentionally) left HTTP as a reverse proxy to your Gitea too, instead of redirecting?

server {
    listen 80;
    server_name git.acaziasoft.com;
    return 301 https://$host$request_uri;
}

@bryanpedini commented on GitHub (May 19, 2020): > It is now working as expected. I had to add extra port mapping to `docker-compose.yml`: > > ``` > ports: > - "3000:3000" > - "22:22" > - "5432:5432" # This one > ``` Well, if you configured your DBMS (Postgres, in this case) on the host machine, yes, you have to forward the port (all tho I don't think that's the way to do it, since Docker probably throws an error for an already bound port on the host). Why then having Gitea inside a Docker container then if you Docker-ize only Gitea and not Postgres too (I mean, there could be reasons, but I currently don't see 'em, okay it's 10am here in Italy and I'm still half asleep, but I still don't see 'em...) <br><br> > And the `[server]` block in `app.ini`. Since my Gitlab is hosted on Google Cloud, it has two IP: Internal and External. GitLab!?!? <br><br> > And the two `server` blocks in `nginx.conf`: > > ``` > server { > listen 80; > listen [::]:80; > server_name git.acaziasoft.com; > > location / { > proxy_pass http://127.0.0.1:3000; > } > } > server { > listen 443 ssl; > listen [::]:443 ssl; > server_name git.acaziasoft.com; > ssl on; > ssl_certificate /etc/letsencrypt/live/git.acaziasoft.com/fullchain.pem; > ssl_certificate_key /etc/letsencrypt/live/git.acaziasoft.com/privkey.pem; > location / { > proxy_pass http://127.0.0.1:3000; # This just simply points to localhost :D > } > access_log /var/log/nginx/gitea-proxy_access.log; > error_log /var/log/nginx/gitea-proxy_error.log; > } > ``` Why didn't you redirected HTTP to HTTPS as I suggested? Is there a particular reason why you (seemingly intentionally) left HTTP as a reverse proxy to your Gitea too, instead of redirecting? ``` server { listen 80; server_name git.acaziasoft.com; return 301 https://$host$request_uri; } ```

GiteaMirror commented

2025-11-02 06:24:37 -06:00

@Doko-Demo-Doa commented on GitHub (May 19, 2020):

No... actually I dockerized db (Postgres too), the code above is just a part of it. The rest is:

  db:
    image: postgres:9.6
    restart: always
    environment:
      - POSTGRES_USER=testdbgit
      - POSTGRES_PASSWORD=testdbgit
      - POSTGRES_DB=testdbgit
    networks:
      - gitea
    volumes:
      - ./postgres:/var/lib/postgresql/data

This is a (mostly) copy-pasted from the Official Guide

Also, thank you for the snippet:

return 301 https://$host$request_uri;

The site now redirects to proper https link. All these are new to me though.

@Doko-Demo-Doa commented on GitHub (May 19, 2020): No... actually I dockerized db (Postgres too), the code above is just a part of it. The rest is: ```yml db: image: postgres:9.6 restart: always environment: - POSTGRES_USER=testdbgit - POSTGRES_PASSWORD=testdbgit - POSTGRES_DB=testdbgit networks: - gitea volumes: - ./postgres:/var/lib/postgresql/data ``` This is a (mostly) copy-pasted from the [Official Guide](https://docs.gitea.io/en-us/install-with-docker/) Also, thank you for the snippet: ``` return 301 https://$host$request_uri; ``` The site now redirects to proper https link. All these are new to me though.

GiteaMirror commented

2025-11-02 06:24:37 -06:00

@bryanpedini commented on GitHub (May 21, 2020):

No... actually I dockerized db (Postgres too), the code above is just a part of it.

Then you don't need 5432:5432 in "ports" section, you need to have a "links" section, where you type in the name of the container you want to link to: see an example here

The site now redirects to proper https link. All these are new to me though.

Glad to have helped!

@bryanpedini commented on GitHub (May 21, 2020): > No... actually I dockerized db (Postgres too), the code above is just a part of it. Then you don't need `5432:5432` in "ports" section, you need to have a "links" section, where you type in the name of the container you want to link to: see an example [here](https://github.com/bryanpedini-docker/webstack-compose) > The site now redirects to proper https link. All these are new to me though. Glad to have helped!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5425