fat-gitea/files/etc/templates/nginx_site_ssl.conf

server {
  listen 80;
  listen [::]:80;

  server_name $GITEA_DOMAIN;

  location /.well-known/acme-challenge/ {
    alias /run/nginx/challenges/;
    try_files $uri =404;
  }

  location / {
    return 301 https://$server_name$request_uri;
  }
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name $GITEA_DOMAIN;
  client_max_body_size 0;
  proxy_http_version 1.1;

  ssl_certificate /data/ssl/cert.crt;
  ssl_certificate_key /data/ssl/cert.key;
  ssl_prefer_server_ciphers on;

  location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}