Saturday, 11 July 2026
nginx reverse proxy on Server A — Gitea moved to a local port, SSL termination handed to nginx, development.rokojori.com restored. Project directory restructure planned for next session.
Installed nginx on Server A (development.rokojori.com). Gitea was previously running directly on port 443 with its own TLS. It was moved to port 4444 on localhost, running plain HTTP. nginx now owns port 443 for the domain and proxies traffic to Gitea internally.
The nginx server block for development.rokojori.com includes
the standard reverse-proxy headers (Host, X-Real-IP,
X-Forwarded-For, X-Forwarded-Proto) and uses
the existing Let's Encrypt certificate.
Gitea's app.ini was updated: PROTOCOL = http,
HTTP_PORT = 4444, ROOT_URL = https://development.rokojori.com/.
Port 4444 was closed in the IONOS firewall so Gitea is only reachable
through nginx.
Gitea's built-in TLS was disabled so that nginx becomes the sole
TLS termination point. This is the standard pattern for a reverse
proxy setup: one certificate, one HTTPS endpoint, all internal
communication over plain HTTP on localhost. It also makes it
straightforward to add a second domain (roject.rokojori.com)
to the same nginx instance later.
Once Gitea dropped its own TLS, port 4444 became an unencrypted HTTP port. Closing it in the IONOS firewall ensures Gitea is unreachable directly from the internet and all traffic must pass through nginx.
A full restructure of the project layout was planned: source/
for all frontend + backend + locale source, build/app/ for
compiled output, build/data/db/ for JSON user data, and
build/data/storage/ for project files. The git submodule
(src/library-ts/) was committed and pushed clean before the
session ended, ready for the git mv that the restructure
requires.
Server A infrastructure only — no source files changed this session.
nginx config: /etc/nginx/sites-available/gitea-server (new)
Gitea config: app.ini — PROTOCOL, HTTP_PORT, ROOT_URL updated
IONOS firewall: port 4444 closed