I am running a Gitea server on a vps mapped to a sub-domain ‘git.domain.com’, which works fine. However, I have tried to add a Verdaccio server (private npm registry) alongside it, using Nginx as a reverse proxy. However, I can’t access the Verdaccio server through its subdomain ‘npm.domain.com’, it just serves the gitea server. Note I am using cloudflare as a DNS and have tried turning off proxy + cache. Note that I can access verdaccio through localhost, and nginx passes to verdacio if curled to the direct IP of the server:
curl --header 'Host: npm.domain.com' [ip] rather than the domain name.

Here are my config details for all related services:

Cloudflare:
A records with name as the subdomain and the server ip as the address.

Nginx config files:

# nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        log_format custom '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$host"';
        access_log /var/log/nginx/access.log custom;

        ##
        # Gzip Settings
        ##

        gzip on;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

# sites-enabled/gitea

server {
    listen 80;
    server_name git.domain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name git.domain.com;

    ssl_certificate /etc/ssl/gitea/cert.pem;
    ssl_certificate_key /etc/ssl/gitea/key.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}


# sites-enabled/verdaccio

server {
    listen 80;
    server_name npm.domain.com;
    return 302 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name npm.domain.com;

    ssl_certificate /etc/ssl/verdaccio/cert.pem;  # Update with the correct path to your SSL certificate
    ssl_certificate_key /etc/ssl/verdaccio/key.pem;  # Update with the correct path to your SSL certificate key

    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://127.0.0.1:4000;  # Update with the correct port for your npm service
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout  600;
        proxy_redirect off;
    }
}
   

Gitea config (app.ini)

[server]
DOMAIN = git.domain.com
HTTP_PORT = 3000
SSH_DOMAIN = [ip]
ROOT_URL = https://git.domain.com:3000/
APP_DATA_PATH = /var/lib/gitea/data
DISABLE_SSH = false
SSH_PORT = 22
LFS_START_SERVER = true
LFS_JWT_SECRET = qCf44EBsS1DlPNZBgSLFiJRqdOsE16fZdRiqtsJHrx4
OFFLINE_MODE = true

storage: ./storage
plugins: ./plugins

web:
  title: Verdaccio

auth:
  htpasswd:
    file: ./htpasswd

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    # scoped packages
    access: $all
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmjs

  '**':
    access: $all

    publish: $authenticated
    unpublish: $authenticated

    proxy: npmjs


server:
  keepAliveTimeout: 60

listen:
  - http://127.0.0.1:4000/ 

https:
  key: /etc/ssl/verdaccio/cert.pem
  cert: /etc/ssl/verdaccio/cert.pem


middlewares:
  audit:
    enabled: true

# log settings
log: { type: stdout, format: pretty, level: http }

I have tried turning off cache and not using a proxy for cloudflare dns. I have also tried to rewrite the host header with rules, but cloudflare doesn’t allow you to do that.

I expect the web gui to load for gitea at ONLY git.domain.com, and the web gui to load for verdaccio at ONLY npm.domain.com.