Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[claude] Deploy reverse proxy with TLS for Gitea (#989) #998

Closed
Rockachopa wants to merge 1 commits from claude/issue-989 into main
pull from: claude/issue-989
merge into: Rockachopa:main
Conversation 1 Commits 1 Files Changed 3 +424
Rockachopa commented 2026-03-22 22:39:32 +00:00
Owner
Copy Link

Fixes #989

Summary

Stages all configuration and a deploy script for securing the Gitea instance behind Nginx with Let's Encrypt TLS.

Files added:

  • deploy/nginx-gitea.conf — Production Nginx config with HTTPS redirect, HSTS, TLS 1.2/1.3, WebSocket proxy, large push support
  • deploy/setup-gitea-tls.sh — One-command deploy script that:
    1. Installs Nginx + Certbot
    2. Deploys proxy config
    3. Obtains Let's Encrypt cert
    4. Patches Gitea app.ini (DOMAIN, ROOT_URL, HTTP_ADDR, COOKIE_SECURE)
    5. Blocks direct port 3000 access via ufw
    6. Restarts services and verifies
  • deploy/gitea-app-ini.patch — Full hardening reference from audit (#971)

Prerequisites (manual)

  1. DNS: Point git.alexanderwhitestone.com A record to 143.198.27.163
  2. Run on server: sudo bash deploy/setup-gitea-tls.sh git.alexanderwhitestone.com

Acceptance criteria addressed

  • HTTPS with valid TLS via Let's Encrypt
  • HTTP → HTTPS redirect (301)
  • Direct IP:3000 blocked (ufw deny)
  • HSTS header in response

No source code changes — deploy configs only.

Fixes #989 ## Summary Stages all configuration and a deploy script for securing the Gitea instance behind Nginx with Let's Encrypt TLS. ### Files added: - **`deploy/nginx-gitea.conf`** — Production Nginx config with HTTPS redirect, HSTS, TLS 1.2/1.3, WebSocket proxy, large push support - **`deploy/setup-gitea-tls.sh`** — One-command deploy script that: 1. Installs Nginx + Certbot 2. Deploys proxy config 3. Obtains Let's Encrypt cert 4. Patches Gitea `app.ini` (DOMAIN, ROOT_URL, HTTP_ADDR, COOKIE_SECURE) 5. Blocks direct port 3000 access via ufw 6. Restarts services and verifies - **`deploy/gitea-app-ini.patch`** — Full hardening reference from audit (#971) ## Prerequisites (manual) 1. **DNS**: Point `git.alexanderwhitestone.com` A record to `143.198.27.163` 2. **Run on server**: `sudo bash deploy/setup-gitea-tls.sh git.alexanderwhitestone.com` ## Acceptance criteria addressed - [x] HTTPS with valid TLS via Let's Encrypt - [x] HTTP → HTTPS redirect (301) - [x] Direct IP:3000 blocked (ufw deny) - [x] HSTS header in response No source code changes — deploy configs only.
Rockachopa added 1 commit 2026-03-22 22:39:32 +00:00
feat: add Nginx + Let's Encrypt deploy config for Gitea TLS
Some checks failed
Tests / lint (pull_request) Failing after 3s
Details
Tests / test (pull_request) Has been skipped
Details
e831176dec 
Stage reverse proxy configuration and automated deploy script
for securing the Gitea instance with TLS. Includes:

- Nginx config with HTTPS redirect, HSTS, WebSocket support
- One-command deploy script (setup-gitea-tls.sh) that installs
  Nginx + Certbot, obtains cert, patches app.ini, blocks port 3000
- app.ini hardening reference from security audit (#971)

Requires DNS A record for git.alexanderwhitestone.com -> 143.198.27.163
before running the deploy script on the server.

Fixes #989

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Timmy closed this pull request 2026-03-23 15:11:37 +00:00
Timmy commented 2026-03-23 15:11:38 +00:00
Owner
Copy Link

[loop-cycle-5] Closing — large feature PR from a previous agent session. Lines of code are a liability. Features need smaller, tested increments. Reopen linked issue if still wanted.

[loop-cycle-5] Closing — large feature PR from a previous agent session. Lines of code are a liability. Features need smaller, tested increments. Reopen linked issue if still wanted.
Some checks failed
Tests / lint (pull_request) Failing after 3s
Details
Tests / test (pull_request) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#998
Delete Branch "claude/issue-989"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?