Cockpit via NGINX - settings make other services not reachable

What's missing here?

The problem occurs not on all devices. Some show up that "This connection is not secure." for redmine and gitlab. But cockpit does not. The solution to the riddle is now, that the rules for Gitlab and Redmine are not complete and the https requests become stuck in nowhere.

The rules for port 443 (https) are missing. Now I changed the blocks into two:

1. Redirect http request to https
2. listen to https requests and forward them to the application

This looks now like this:

/etc/nginx/sites-available/gitlab.<myserver> linked to /etc/nginx/sites-enabled/gitlab.<myserver>

# redirect http request to https while keeping the request uri
server {

    listen 80;
    listen [::]:80;

    server_name gitlab.<myserver>;

    return 301 https://gitlab.<myserver>$request_uri;
}

# https requests will forwarded to the server application
server {

    listen 443 ssl;
    listen [::]:443 ssl;

    server_name gitlab.<myserver>;

    location / {
        proxy_pass         http://<docker-net-ip>:<port>;
        proxy_buffering    off;
        proxy_set_header   X-Real-IP       $remote_addr;

        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        gzip off;
    }
}

/etc/nginx/sites-available/redmine.<myserver> linked to /etc/nginx/sites-enabled/redmine.<myserver>

# redirect http request to https while keeping the request uri
server {

    listen 80;
    listen [::]:80;

    server_name redmine.<myserver>;

    return 301 https://redmine.<myserver>$request_uri;
}

# https requests will forwarded to the server application
server {

    listen 443 ssl;
    listen [::]:443 ssl;

    server_name redmine.<myserver>;

    location / {
        proxy_pass         http://<docker-net-ip>:<port>;
        proxy_set_header   Host                $host;
        proxy_set_header   X-Real-IP           $remote_addr;
        proxy_set_header   X-Forwarded-for     $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto   $scheme;

        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        gzip off;
    }
}

/etc/nginx/sites-available/cockpit.<myserver> linked to /etc/nginx/sites-enabled/cockpit.<myserver>

server {
    listen         80;
    listen         443 ssl;

    server_name    cockpit.<myserver>;

    location / {
        # Required to proxy the connection to Cockpit
        proxy_pass https://127.0.0.1:9090;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Required for web sockets to function
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Pass ETag header from Cockpit to clients.
        # See: https://github.com/cockpit-project/cockpit/issues/5239
        gzip off;
    }
}

and /etc/cockpit/cockpit.conf

[WebService]
Origins = https://cockpit.<myserver> 127.0.0.1:9090
ProtocolHeader = X-Forwarded-Proto

[Log]
Fatal = /var/log/cockpit.log

[Session]
IdleTimeout=15

and for beeing complete:
/etc/nginx/sites-available/default linked to /etc/nginx/sites-enabled/default

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or WordPress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html;

    error_log /opt/logs/certbot_error debug;
}