diff --git a/configuration.nix b/configuration.nix
index 1eace91..fc8eb38 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -2,14 +2,14 @@
 
 {
   boot.isContainer = true;
-  # creates /sbin/init
-  boot.loader.initScript.enable = true;
+  boot.loader.initScript.enable = true; ## creates /sbin/init
   nix.useSandbox = false;
 
   imports = [
      ./modules/nix.nix
      ./modules/networking.nix
      ./modules/gitea.nix
+     ./modules/nginx.nix
 
      ./modules/admin.nix
      ./modules/ssh.nix
diff --git a/migrate.sh b/migrate.sh
index 1591f18..da73d11 100755
--- a/migrate.sh
+++ b/migrate.sh
@@ -1,6 +1,6 @@
 #/usr/bin/env bash -e
 
-DUMP=gitea-dump-1630784448
+DUMP=gitea-dump-1633035257
 USER=gitea
 DATABASE=gitea
 
@@ -10,9 +10,10 @@ unzip gitea-repo.zip
 
 systemctl stop gitea
 
+rm -r /var/lib/gitea/repositories/*
 mv gitea-repositories/* /var/lib/gitea/repositories/
 chown -R gitea:gitea /var/lib/gitea
 
-psql -U $USER -d $DATABASE < gitea-db.sql
+sudo -u gitea psql -U $USER -d $DATABASE < gitea-db.sql
 
 systemctl start gitea
diff --git a/modules/gitea.nix b/modules/gitea.nix
index d22a8fe..0bd7f2f 100644
--- a/modules/gitea.nix
+++ b/modules/gitea.nix
@@ -32,6 +32,7 @@
         START_SSH_SERVER = true;
         SSH_DOMAIN = domain;
         SSH_PORT = ssh.clonePort;
+        ENABLE_GZIP = true;
       };
       mailer = {
         ENABLED = true;
@@ -45,6 +46,12 @@
         REGISTER_EMAIL_CONFIRM = true;
         ENABLE_NOTIFY_MAIL = true;
       };
+      database = {
+        LOG_SQL = false;
+      };
+      time = {
+        DEFAULT_UI_LOCATION = config.time.timeZone;
+      };
     };
   };
 
diff --git a/modules/nginx.nix b/modules/nginx.nix
new file mode 100644
index 0000000..9c42a8d
--- /dev/null
+++ b/modules/nginx.nix
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+{
+  security.acme = {
+    email = "admin@c3d2.de";
+    acceptTerms = true;
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."gitea.c3d2.de" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass = "http://localhost:3000";
+    };
+  };
+}