Apache를 리버스 프록시로 사용하는 Gitea SSL

DEV Community · Rost · 2026-09-11 개발(SW)

We want to host a nice and secure container registry – to push docker images there and our kubernetes cluster would pull them from this registry.
So came the idea to use the gitea over ssl.

Part of Developer Tools: The Complete Guide to Modern Development Workflows

1) Gitea already has container registry
2) Apache as TLS terminating proxy will add HTTPS to our Gitea.
3) That how it’s started… Rot CA, self-signed certificates…

When we need the registry in k8s

Unfortunately registry in kubernetes cluster created by kubespray doesn’t work for me.

to push into it we need to create temporary tunnel via kube-proxy
after pushing into it mu current version of new cluster could not pull images from this internal registry

After spending some awesome two evenings trying to fix it,
I have decided just to use Gitea’s internal container registry, just need to configure HTTPS access to it.

Will make it public anyway, so docker and k8s doesn’t have to do any docker logins.
Maybe. Let’s see how we go.

Testing if it’s working

To test if container registry suits us we want to be able

to push image there and
to create deployment in k8s from that image

sudo docker pull alpine:3.12.0
sudo docker images
sudo docker tag a24bb4013296 localhost:5000/rg/alpine:version.3.12.0
sudo docker push localhost:5000/rg/alpine:version.3.12.0

Enter fullscreen mode Exit fullscreen mode

Now xed alp1.yaml or nano alp1.yaml depending on what mood you are in and

apiVersion: apps/v1
kind: Deployment
metadata:
  name: alp-registry-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alp-registry-test
  template:
    metadata:
      labels:
        app: alp-registry-test
    spec:
      containers:
        - name: alpine-test
          image: localhost:5000/rg/lpine:version.3.12.0
      imagePullSecrets:
      - name: registry-secret

Enter fullscreen mode Exit fullscreen mode

Here is this file available for download
Then creating this deployment

kubectl create -f alp1.yaml
kubectl get pods

kubectl describe po alp-registry-test-5f5cb94b97-njsp2
# or whatever pod was created or wasn't created

Enter fullscreen mode Exit fullscreen mode

Yes I know about this bit

      imagePullSecrets:
      - name: registry-secret

Enter fullscreen mode Exit fullscreen mode

registry-secret is the name of the secret kubespray created.

Cleanup

kubectl delete -f alp1.yaml

Enter fullscreen mode Exit fullscreen mode

How

A bunch of documentation is available on Gitea site: https-setup

And on that page: https://docs.gitea.com/administration/reverse-proxies

Step 1 – Install Apache and create simple test site

Install Apache

sudo apt install apache2

Enter fullscreen mode Exit fullscreen mode

Check what we have in the firewall

sudo ufw status

Enter fullscreen mode Exit fullscreen mode

If firewall is active think which port you want to expose via https and allow it.
Standart apache configs are

sudo ufw app list

Enter fullscreen mode Exit fullscreen mode

We might see something like

Available applications:
  Apache
  Apache Full
  Apache Secure
  OpenSSH

Enter fullscreen mode Exit fullscreen mode

and to enable only port 443 we execute

sudo ufw allow 'Apache Secure'

Enter fullscreen mode Exit fullscreen mode

ok. now check the service status

sudo systemctl status apache2

Enter fullscreen mode Exit fullscreen mode

Next – create simple virtual server to test the Apache

sudo mkdir /var/www/reg.homelab
sudo chown -R $USER:$USER /var/www/reg.homelab
sudo chmod -R 755 /var/www/reg.homelab
sudo nano /var/www/reg.homelab/index.html

Enter fullscreen mode Exit fullscreen mode

Put there

<html>
    <head>
        <title>Welcome to reg.homelab!</title>
    </head>
    <body>
        <h1>Success!  The reg.homelab virtual host is working!</h1>
    </body>
</html>

Enter fullscreen mode Exit fullscreen mode

then

sudo nano /etc/apache2/sites-available/reg.homelab.conf

Enter fullscreen mode Exit fullscreen mode

and put there

<VirtualHost *:3080>
    ServerAdmin webmaster@localhost
    ServerName reg.homelab
    ServerAlias www.reg.homelab
    DocumentRoot /var/www/reg.homelab
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Enter fullscreen mode Exit fullscreen mode

then disable default site, enable this one and check how we are doing

sudo a2ensite reg.homelab.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest

Enter fullscreen mode Exit fullscreen mode

see something like this?

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message

Enter fullscreen mode Exit fullscreen mode

then

sudo nano /etc/apache2/apache2.conf

Enter fullscreen mode Exit fullscreen mode

add to the end:

ServerName reg.homelab

Enter fullscreen mode Exit fullscreen mode

And this is still not the end! now need to remove port 80 binding attempt

sudo nano /etc/apache2/ports.conf

Enter fullscreen mode Exit fullscreen mode

put there

Listen 3030
...
Listen 443

Enter fullscreen mode Exit fullscreen mode

And now

sudo systemctl restart apache2
sudo systemctl status apache2
journalctl -xeu apache2.service
curl localhost:3080

Enter fullscreen mode Exit fullscreen mode

OK! Now navigate to :3080

Step 2 – Converting this site to insecure reverse proxy 🙂 to Gitea

sudo nano /etc/apache2/sites-available/reg.homelab.conf

Enter fullscreen mode Exit fullscreen mode

putting there

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    ServerName reg.homelab
    ServerAlias www.reg.homelab
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    ProxyPreserveHost On
    ProxyRequests off
    AllowEncodedSlashes NoDecode
    ProxyPass / http://localhost:3000/ nocanon
</VirtualHost>

Enter fullscreen mode Exit fullscreen mode

Do some config test

sudo apache2ctl configtest

Enter fullscreen mode Exit fullscreen mode

Add some apache modules and restart Apache

sudo a2enmod proxy proxy_http ssl
sudo systemctl restart apache2
sudo systemctl status apache2

Enter fullscreen mode Exit fullscreen mode

OK, now navigate to or curl

# Yes, it is still a http, but on the 443 port
curl http://localhost:443
http://<Server_IP_Address>:443/

Enter fullscreen mode Exit fullscreen mode

Step 3 Self – signed root CA and site cert

SweetHome-RootCA.

CANAME=MostImportant-RootCA

# optional, create a directory
mkdir $CANAME
cd $CANAME

# generate aes encrypted private key
openssl genrsa -aes256 -out $CANAME.key 4096

# create certificate, 1826 days = 5 years
openssl req -x509 -new -nodes -key $CANAME.key -sha256 -days 1826 -out $CANAME.crt -subj '/CN=My Root CA/C=AT/ST=Vienna/L=Vienna/O=MyOrganisation'

# create certificate for service
MYCERT=reg.homelab
openssl req -new -nodes -out $MYCERT.csr -newkey rsa:4096 -keyout $MYCERT.key -subj '/CN=My Firewall/C=AT/ST=Vienna/L=Vienna/O=MyOrganisation'

# create a v3 ext file for SAN properties
cat > $MYCERT.v3.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = reg.homelablab
DNS.2 = gitea.homelablab
IP.1 = 192.168.0.10
IP.2 = 192.168.0.11
EOF

openssl x509 -req -in $MYCERT.csr -CA $CANAME.crt -CAkey $CANAME.key -CAcreateserial -out $MYCERT.crt -days 730 -sha256 -extfile $MYCERT.v3.ext

Enter fullscreen mode Exit fullscreen mode

On machines connecting to gitea / registry

sudo cp MostImportant-RootCA.crt /usr/local/share/ca-certificates
sudo update-ca-certificates

Enter fullscreen mode Exit fullscreen mode

Registre root certificate on windows:

Doubleclick file MostImportant-RootCA.crt
Import to local user
Select Truster Root CA.
When prompted about importing untrusted certificate – click yes

When git pull on windows says about

Unable to resolve "unable to get local issuer certificate...

Enter fullscreen mode Exit fullscreen mode

you can tell git to use windows networking layer by

git config --global http.sslbackend schannel

Enter fullscreen mode Exit fullscreen mode

Step 4 – Securing proxy with self-signed certificate

https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html

Create a self-signed certificate IF you didn’t in step 3

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -subj "/CN=reg.homelab" \
  -addext "subjectAltName = DNS:reg.homelab" \
  -keyout /etc/ssl/private/apache-selfsigned-reg.homelab.key \
  -out /etc/ssl/certs/apache-selfsigned-reg.homelab.crt

Enter fullscreen mode Exit fullscreen mode

Or just take it from previous step

sudo cp reg.homelab.crt /etc/ssl/certs/apache-selfsigned-reg.homelab.crt
sudo cp reg.homelab.key /etc/ssl/private/apache-selfsigned-reg.homelab.key

Enter fullscreen mode Exit fullscreen mode

Again, open virtual host config

sudo nano /etc/apache2/sites-available/reg.homelab.conf

Enter fullscreen mode Exit fullscreen mode

Add there to the bottom the SSL section with certs

<VirtualHost *:443>
   ServerAdmin webmaster@localhost
   ServerName reg.homelab
   ServerAlias www.reg.homelab
   ErrorLog ${APACHE_LOG_DIR}/error.log
   CustomLog ${APACHE_LOG_DIR}/access.log combined
   ProxyPreserveHost On
   ProxyRequests off
   AllowEncodedSlashes NoDecode
   ProxyPass / http://localhost:3000/ nocanon

   SSLEngine on
   SSLCertificateFile /etc/ssl/certs/apache-selfsigned-reg.homelab.crt
   SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned-reg.homelab.key
</VirtualHost>

Enter fullscreen mode Exit fullscreen mode

Check config, restart server, check status and navigate to our Gitea over SSL

sudo apache2ctl configtest
sudo systemctl restart apache2
sudo systemctl status apache2

# goto: http://<Server_IP_Address>:443/
# or
curl -k -v https://localhost

Enter fullscreen mode Exit fullscreen mode

the browser will warn about the self-signed certificate

Your connection is not private
Attackers might be trying to steal your information from reg.homelab (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID

Enter fullscreen mode Exit fullscreen mode

But we will ignore it, for now, till we use Let’s Encrypt.

Note: Once your Gitea SSL setup is working, consider backing up your server. See Backup and Restore Gitea server for detailed instructions.

Now k8s test

Do some DNSing…

On each k8s node:

sudo nano /etc/hosts

Enter fullscreen mode Exit fullscreen mode

and add there

192.168.18.200 gitea.homelab
192.168.18.200 reg.homelab

Enter fullscreen mode Exit fullscreen mode

Root CA

On each k8s node:

sudo cp SweetHome-RootCA.crt /usr/local/share/ca-certificates
sudo update-ca-certificates

Enter fullscreen mode Exit fullscreen mode

And restart now

Create secret with registry credentials

https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

sudo docker login reg.homelab
kubectl create secret generic regcred --from-file=.dockerconfigjson=/home/rg/.docker/config.json --type=kubernetes.io/dockerconfigjson

Enter fullscreen mode Exit fullscreen mode

kubectl create secret docker-registry regcred --docker-server=your-registry-server --docker-username=your-name --docker-password=your-pword --docker-email=your-email

Enter fullscreen mode Exit fullscreen mode

New docker image and k8s deployment

sudo docker pull alpine:3.12.0
sudo docker images
sudo docker tag a24bb4013296 reg.homelab/rg/alpine:version.3.12.0
sudo docker push reg.homelab/rg/alpine:version.3.12.0

Enter fullscreen mode Exit fullscreen mode

Now nano alp2.yaml, file is [avaliable]avaliable

apiVersion: apps/v1
kind: Deployment
metadata:
  name: alp-registry-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alp-registry-test
  template:
    metadata:
      labels:
        app: alp-registry-test
    spec:
      containers:
        - name: alpine-test
          image: reg.homelab/rg/alpine:version.3.12.0
      imagePullSecrets:
      - name: regcred

Enter fullscreen mode Exit fullscreen mode

Here is this file available for download:
Then creating this deployment

kubectl create -f alp2.yaml
kubectl get pods
kubectl describe po alp...

Enter fullscreen mode Exit fullscreen mode

Cleanup

kubectl delete -f alp2.yaml

Enter fullscreen mode Exit fullscreen mode

Useful links

원문에서 계속 ↗

추출 본문 · 출처: dev.to · https://dev.to/rosgluk/gitea-ssl-with-apache-as-reverse-proxy-12ap

Apache를 리버스 프록시로 사용하는 Gitea SSL

When we need the registry in k8s

Testing if it’s working

How

Step 1 – Install Apache and create simple test site

Step 2 – Converting this site to insecure reverse proxy 🙂 to Gitea

Step 3 Self – signed root CA and site cert

SweetHome-RootCA.

Step 4 – Securing proxy with self-signed certificate

Now k8s test

Do some DNSing…

Root CA

Create secret with registry credentials

New docker image and k8s deployment

Useful links

더 많은 게시물

에피소드 1: “세상에 나타난 작은 점”