Gitea Behind Reverse Proxy
To run gitea behind reverse proxy, route web traffic through your front server to Gitea. Then match your external domain settings to the internal port where the Git service listens. Teams use this setup to keep internal ports private and manage TLS certificates in one place. Still, this approach often leaves host access and backend database roles way too broad. Admin users who log in to fix routing issues gain full control over the host. How to set up gitea behind reverse proxy Setting up thi
Reverse Proxy Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To run gitea behind reverse proxy, route web traffic through your front server to Gitea. Then match your external domain settings to the internal port where the Git service listens. Teams use this setup to keep internal ports private and manage TLS certificates in one place. Still, this approach often leaves host access and backend database roles way too broad. Admin users who log in to fix routing issues gain full control over the host.
How to set up gitea behind reverse proxy
Setting up this architecture starts with two core network paths. Gitea handles both web requests and Git data transfers over SSH. Your front web server takes incoming HTTPS requests from users on the public network. It handles the TLS encryption and forwards clean HTTP traffic to the local Gitea port. For this to work, Gitea needs to know its public web address. You set the base URL in the Gitea app file to match the external domain.
Next, you must set up header forwarding on the front server. The front server must pass the client IP address and protocol headers to Gitea. Without these headers, Gitea logs every single login as coming from the local server. It will also build broken links that use plain HTTP instead of HTTPS. Large code pushes can also fail if the front server blocks big web requests. You need to raise the body size limit on the front server to allow large pushes.
Handling SSH traffic and internal server roles
Web traffic is only half of the setup when hosting Git repos. Developers also push and pull code using SSH keys. A standard web server only routes HTTP traffic by default. If your Gitea instance runs on a custom SSH port, you have two choices. You can bypass the front server for SSH and open the port directly. Or you can use TCP stream routing on the front server to forward SSH traffic.
This network setup gets traffic to the app, but admins still need host access. Engineers log in to the host machine to edit web server files and check logs. They also open the Gitea database to fix stuck migrations or broken user accounts. Most teams grant full root access or shared database keys for these daily tasks. An engineer who only needs to read a log file can now alter any repo.
Reverse Proxy Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What the native setup solves and what it misses
Putting a web server in front of Gitea solves key network routing problems. It lets you host multiple web apps on one single IP address. It also keeps TLS certificate updates in one central place. Your Gitea service can run as a basic user without binding to privileged ports. This keeps the external network layout clean and easy to manage for small teams.
Still, network routing only controls how traffic reaches the front door of the app. It does not control what engineers do once they log in to the backend host. Native server roles decide who can enter the machine or open the database. They do not inspect individual commands or SQL queries while they run. One wrong command during a routine fix can wipe out source code or leak secrets. Also, if customer emails or phone numbers sit in issue trackers, standard logs expose them. You need a way to check commands in flight and rewrite sensitive data in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why do my Gitea clone links show the wrong port or protocol?
Gitea builds repo links using the root URL set in its main settings file. Make sure that value matches the exact HTTPS address of your front server.
Why do large Git pushes fail over HTTPS?
Most front web servers cap the size of incoming requests by default. You must raise the maximum body size limit on your front server to fix this.
How do I see real user IP addresses in Gitea logs?
Set your front server to send forwarding headers with every request it passes along. Then tell Gitea to trust the local IP address of that front server.