How to disallow HTTP access to gui?

It's nginx so yes, you can do it with a custom CA or even a real CA.
This should work on the router itself: How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 18.04 | DigitalOcean