Connecting Gitea and WireGuard: A Guide (NGINX works, but not only with WireGuard)

Connecting Gitea and WireGuard VPN with NGINX (Works without WireGuard too)

Gitea is an open-source, self-hosted Git service that allows you to manage your code repositories. WireGuard is a simple, fast, and modern VPN that aims to be faster, simpler, and more secure than traditional VPNs. NGINX is a web server that can act as a reverse proxy and load balancer.

Prerequisites

In this guide, we assume that you have already set up Gitea on Docker Alpine Linux or Windows-hosted Oracle VM VirtualBox. We will also assume that you have basic knowledge of Linux command line and Docker. Additionally, we will use NGINX as a reverse proxy for Gitea, so some knowledge of NGINX configuration is recommended.

Why use WireGuard?

WireGuard provides a secure and fast VPN connection between your Gitea server and your local machine. It encrypts all traffic between the two endpoints, providing an additional layer of security. Additionally, WireGuard is faster and simpler to set up than traditional VPNs, making it an ideal choice for Gitea administrators.

Setting up WireGuard

To set up WireGuard, you need to generate keys and configure the WireGuard interface on both the server and the client. Here's how to do it:

1. Generate keys for the server:

wg genkey | tee server-private-key > server-public-key

2. Configure the WireGuard interface on the server:

echo "
[Interface]
Address = 10.0.0.1/24
PrivateKey = $server\_private\_key
ListenPort = 51820

[Peer]
PublicKey = $client\_public\_key
AllowedIPs = 10.0.0.2/32
Endpoint = $client\_ip:51820
" > /etc/wireguard/wg0.conf

3. Generate keys for the client:

wg genkey | tee client-private-key > client-public-key

4. Configure the WireGuard interface on the client:

echo "
[Interface]
Address = 10.0.0.2/24
PrivateKey = $client\_private\_key

[Peer]
PublicKey = $server\_public\_key
Endpoint = $server\_ip:51820
AllowedIPs = 10.0.0.1/32
PersistentKeepalive = 25
" > /etc/wireguard/wg0.conf

5. Start the WireGuard interface on both the server and the client:

systemctl start wg-quick@wg0

Setting up NGINX

To set up NGINX as a reverse proxy for Gitea, you need to configure NGINX to forward requests to the Gitea container. Here's how to do it:

1. Create a new NGINX configuration file:

sudo nano /etc/nginx/sites-available/gitea

2. Add the following configuration:

server {
listen 80;
server\_name gitea.example.com;

location / {
proxy\_pass http://gitea:3000;
proxy\_set\_header Host $host;
proxy\_set\_header X-Real-IP $remote\_addr;
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
proxy\_set\_header X-Forwarded-Proto $scheme;
}
}

3. Enable the new configuration:

sudo ln -s /etc/nginx/sites-available/gitea /etc/nginx/sites-enabled/

4. Test the configuration:

sudo nginx -t

5. Restart NGINX:

sudo systemctl restart nginx

Connecting to Gitea

To connect to Gitea, you need to use the NGINX reverse proxy URL. If you have set up a domain name, you can use that. Otherwise, you can use the IP address of the server. Here's how to do it:

1. Connect to the WireGuard VPN:

sudo wg-quick up wg0

2. Open a web browser and navigate to the Gitea URL:

http://gitea.example.com

In this guide, we have shown you how to connect Gitea and WireGuard VPN with NGINX. This setup provides an additional layer of security and allows you to access Gitea from anywhere. Additionally, we have shown you how to connect to Gitea without WireGuard VPN.

References

• Gitea: https://gitea.io/
• WireGuard: https://www.wireguard.com/
• NGINX: https://nginx.org/

Types of references:

• Online resources