🗄️ Security for CogStack provided other services

General services TLS configuration

All services in cogstack that are not listed in deploy/services.ymland use TLS will be described on this page. For services that are still part of the stack but in dervices/<SERVICE_NAME> (again, service not also present in deploy/services.yml) the TLS setup is handled differently, and the setup is described in each service's README.md. Generally, most should just use the root-ca certs from security/certificates/root/.

Gitea TLS Configuration

This section describes how Gitea is secured using the shared Root Certificate Authority (CA) generated by create_root_ca_cert.sh.

Unlike other services (such as NiFi or Elastic), Gitea does not require its own dedicated certificate pair or an NGINX reverse proxy. It operates directly with the Root CA to provide HTTPS encryption and mutual trust within the CogStack-NiFi stack.

📁 Certificate source

All certificates used by Gitea originate from:

security/certificates/root/

File	Purpose
`root-ca.pem`	Public CA certificate used by Gitea for HTTPS trust
`root-ca.key`	Root CA private key (used only when generating new certificates)
`root-ca.p12`	Optional PKCS#12 keystore (not required by Gitea)

🧠 Notes

The Root CA (root-ca.pem) is shared across all CogStack services for internal TLS trust.
You do not need to create a new gitea.crt or gitea.key; the Root CA cert/key pair is sufficient.
Ensure root-ca.key remains private and is not committed to version control.
The same CA also secures NiFi, ElasticSearch, OpenSearch, Kibana, and JupyterHub.

✅ Verification

To confirm Gitea is serving HTTPS correctly:

curl -vk --cacert ./security/certificates/root/root-ca.pem https://gitea.local:2222/

You should see a valid TLS handshake and an HTTP 200 response.