Nginx

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

# Load balancing pool for Reposilite
upstream reposilite {
    # Reposilite IP and port, see below for explanation
    server domain.com:8081;
}

server {
    server_name domain.com;
    listen 80;
    listen [::]:80;
    access_log /var/log/nginx/reverse-access.log;
    error_log /var/log/nginx/reverse-error.log;

    client_max_body_size 50m; # maximum allowed artifact upload size

    location / {
        proxy_pass http://reposilite; # the name of Reposilite's upstream specified above
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        $connection_upgrade;
        proxy_http_version 1.1;
    }
}

location /reposilite/ {
    rewrite /reposilite/(.*) /$1 break;
    # [...]
}

# Custom base path
basePath: /reposilite/

$ sudo snap install certbot --classic
$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

$ sudo certbot certonly --standalone

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

# Prepare easy to use header value for websocket connections - needs to be outside server block

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

server {
  server_name repo.example.com;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  include /etc/nginx/custom-snippets/ssl.conf;

  location / {
    proxy_pass http://localhost:8080/; # 8080 is the port Reposilite is running on in this setup
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
  }

  ssl_certificate /etc/letsencrypt/live/repo.example.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/repo.example.com/privkey.pem; # managed by Certbot
}

# Redirect all http requests to https

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  return 301 https://$host$request_uri;
}

# Protocols
ssl_protocols TLSv1.2 TLSv1.3;
# Ciphers
ssl_ciphers EECDH+AESGCM:EECDH+AES256;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

# Diffie-Hellman key exchange with better parameters
# Needs to be created via openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_ecdh_curve secp384r1;

# HTTP Strict Transport Security
add_header Strict-Transport-Security "max-age=63072000;includeSubdomains;";