will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix nginx SNI for Cloudflare upstream TLS

Browse Source 
Without proxy_ssl_server_name on, nginx connects to Cloudflare's IP
without SNI, triggering handshake_failure (alert 40). Cloudflare requires
SNI to route TLS to the correct origin.
This commit is contained in:
Will Anderson
2026-05-05 04:41:46 -05:00
parent cebaf44db3
commit 464b33a176
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/gitea-runner/gitea-proxy.yaml
+4 -1
View File
@@ -31,6 +31,9 @@ data:
proxy_set_header CF-Access-Client-Id "${CF_ACCESS_CLIENT_ID}"; proxy_set_header CF-Access-Client-Id "${CF_ACCESS_CLIENT_ID}";
proxy_set_header CF-Access-Client-Secret "${CF_ACCESS_CLIENT_SECRET}"; proxy_set_header CF-Access-Client-Secret "${CF_ACCESS_CLIENT_SECRET}";
# Send SNI so Cloudflare routes the TLS connection correctly.
proxy_ssl_server_name on;
# Preserve Host so Gitea/CF edge routes correctly. # Preserve Host so Gitea/CF edge routes correctly.
proxy_set_header Host git.neuralplatform.ai; proxy_set_header Host git.neuralplatform.ai;
@@ -58,7 +61,7 @@ metadata:
name: gitea-proxy-secret name: gitea-proxy-secret
namespace: ci namespace: ci
annotations: annotations:
force-sync: "2026-05-05-initial" force-sync: "2026-05-05-sni-fix"
spec: spec:
refreshInterval: 1h refreshInterval: 1h
secretStoreRef: secretStoreRef: