Итак, я только что установил gitlab на моем сервере. Я запускаю пакет nginx на порте 256и настроил https с помощью Let's ecnrypt. Есть еще небольшая проблема, вы можете получить к ней доступ через обычный http-адрес, который выдаст ошибку nginx, так как мой внешний адрес есть https://example.com:256. Так что я установил redirect_http_to_https settingи теперь все запросы просто тайм-аут ... Есть идеи?
Мой конфиг gitlab.rb:
## Url on which GitLab will be reachable. ## For more details on configuring external_url see: ## https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/config$ external_url 'https://example.com:256' ##################### # GitLab Web server # ##################### ## see: https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master/doc/settings/nginx.md#using-a-non-bundled-web-server ## When bundled nginx is disabled we need to add the external webserver user to the GitLab webserver group. # web_server['external_users'] = [] # web_server['username'] = 'gitlab-www' # web_server['group'] = 'gitlab-www' # web_server['uid'] = nil # web_server['gid'] = nil # web_server['shell'] = '/bin/false' # web_server['home'] = '/var/opt/gitlab/nginx' ################ # GitLab Nginx # ################ ## see: https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master/doc/settings/nginx.md nginx['enable'] = true # nginx['client_max_body_size'] = '250m' nginx['redirect_http_to_https'] = true # nginx['redirect_http_to_https_port'] = 8080 # nginx['ssl_client_certificate'] = "/etc/gitlab/ssl/ca.crt" # Most root CA's are included by default # nginx['ssl_verify_client'] = "off" # enable/disable 2-way SSL client authentication # nginx['ssl_verify_depth'] = "1" # if ssl_verify_client on, verification depth in the client certificates chain nginx['ssl_certificate'] = "/etc/letsencrypt/live/example.com-0001/fullchain.pem" nginx['ssl_certificate_key'] = "/etc/letsencrypt/live/example.com-0001/privkey.pem" # nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256" # nginx['ssl_prefer_server_ciphers'] = "on" # nginx['ssl_protocols'] = "TLSv1 TLSv1.1 TLSv1.2" # recommended by https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/ # nginx['ssl_session_cache'] = "builtin:1000 shared:SSL:10m" # recommended in http://nginx.org/en/docs/http/ngx_http_ssl_module.html # nginx['ssl_session_timeout'] = "5m" # default according to http://nginx.org/en/docs/http/ngx_http_ssl_module.html # nginx['ssl_dhparam'] = nil # Path to dhparams.pem, eg. /etc/gitlab/ssl/dhparams.pem # nginx['listen_addresses'] = ['*'] # nginx['listen_port'] = nil # override only if you use a reverse proxy: https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/nginx.md#setting-the-nginx-listen-port # nginx['listen_https'] = nil # override only if your reverse proxy internally communicates over HTTP: https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/nginx.md#supporting-proxied-ssl nginx['custom_gitlab_server_config'] = "location ^~ /.well-known { root /var/www/letsencrypt; }" # nginx['custom_nginx_config'] = "include /etc/nginx/conf.d/example.conf;" # nginx['proxy_read_timeout'] = 3600 # nginx['proxy_connect_timeout'] = 300 # nginx['proxy_set_headers'] = { # "Host" => "$http_host", # "X-Real-IP" => "$remote_addr", # "X-Forwarded-For" => "$proxy_add_x_forwarded_for", # "X-Forwarded-Proto" => "https", # "X-Forwarded-Ssl" => "on" # } # nginx['proxy_cache_path'] = 'proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2' # nginx['proxy_cache'] = 'gitlab' # nginx['http2_enabled'] = true # nginx['real_ip_trusted_addresses'] = [] # nginx['real_ip_header'] = nil # nginx['real_ip_recursive'] = nil
Я забыл упомянуть, что доступ к сайту через https работает, если перенаправление не включено. Проблема в том, что вы все еще можете получить доступ к нему через http.