The proxy configuration GitLab usually gets wrong
external_url is your HTTPS address with nginx["listen_https"] = false and listen_port = 80. That exact combination makes GitLab emit https:// clone URLs while its internal nginx listens on plain HTTP behind a terminating proxy. Get it wrong and every clone URL it hands out is unusable.