mirror of
https://github.com/sameersbn/docker-gitlab.git
synced 2026-01-18 13:58:25 +00:00
Merge branch 'feature/gitlab-7.0.0'
This commit is contained in:
Sameer Naik
commit
9f174b05e6
@ -1,6 +1,7 @@
|
||||
# Changelog
|
||||
|
||||
**latest**
|
||||
- upgrade to gitlab-7.0.0
|
||||
- fix repository and gitlab-satellites directory permissions.
|
||||
- added GITLAB_RESTRICTED_VISIBILITY configuration option
|
||||
- fix backup restore operation
|
||||
|
||||
56
README.md
56
README.md
@ -51,7 +51,7 @@
|
||||
Dockerfile to build a GitLab container image.
|
||||
|
||||
## Version
|
||||
Current Version: 6.9.2
|
||||
Current Version: 7.0.0
|
||||
|
||||
# Hardware Requirements
|
||||
|
||||
@ -100,7 +100,7 @@ docker pull sameersbn/gitlab:latest
|
||||
Since version 6.3.0, the image builds are being tagged. You can now pull a particular version of gitlab by specifying the version number. For example,
|
||||
|
||||
```bash
|
||||
docker pull sameersbn/gitlab:6.9.2
|
||||
docker pull sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
Alternately you can build the image yourself.
|
||||
@ -118,7 +118,7 @@ Run the gitlab image
|
||||
docker run --name='gitlab' -i -t --rm \
|
||||
-p 10022:22 -p 10080:80 \
|
||||
-e "GITLAB_PORT=10080" -e "GITLAB_SSH_PORT=10022" \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
__NOTE__: Please allow a couple of minutes for the GitLab application to start.
|
||||
@ -143,7 +143,7 @@ Volumes can be mounted in docker by specifying the **'-v'** option in the docker
|
||||
mkdir /opt/gitlab/data
|
||||
docker run --name=gitlab -d \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
## Database
|
||||
@ -170,7 +170,7 @@ This docker image is configured to use a MySQL database backend. The database co
|
||||
mkdir /opt/gitlab/mysql
|
||||
docker run --name=gitlab -d \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
-v /opt/gitlab/mysql:/var/lib/mysql sameersbn/gitlab:6.9.2
|
||||
-v /opt/gitlab/mysql:/var/lib/mysql sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
This will make sure that the data stored in the database is not lost when the image is stopped and started again.
|
||||
@ -194,7 +194,7 @@ To make sure the database is initialized start the container with **app:rake git
|
||||
docker run --name=gitlab -i -t --rm \
|
||||
-e "DB_HOST=192.168.1.100" -e "DB_NAME=gitlabhq_production" -e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:setup
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:setup
|
||||
```
|
||||
|
||||
**NOTE: The above setup is performed only for the first run**.
|
||||
@ -205,7 +205,7 @@ This will initialize the gitlab database. Now that the database is initialized,
|
||||
docker run --name=gitlab -d \
|
||||
-e "DB_HOST=192.168.1.100" -e "DB_NAME=gitlabhq_production" -e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
#### Linking to MySQL Container
|
||||
@ -250,7 +250,7 @@ docker run --name=gitlab -i -t --rm --link mysql:mysql \
|
||||
-e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-e "DB_NAME=gitlabhq_production" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:setup
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:setup
|
||||
```
|
||||
|
||||
**NOTE: The above setup is performed only for the first run**.
|
||||
@ -262,7 +262,7 @@ docker run --name=gitlab -d --link mysql:mysql \
|
||||
-e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-e "DB_NAME=gitlabhq_production" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
### PostgreSQL
|
||||
@ -284,7 +284,7 @@ To make sure the database is initialized start the container with **app:rake git
|
||||
docker run --name=gitlab -i -t --rm \
|
||||
-e "DB_TYPE=postgres" -e "DB_HOST=192.168.1.100" -e "DB_NAME=gitlabhq_production" -e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:setup
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:setup
|
||||
```
|
||||
|
||||
**NOTE: The above setup is performed only for the first run**.
|
||||
@ -295,7 +295,7 @@ This will initialize the gitlab database. Now that the database is initialized,
|
||||
docker run --name=gitlab -d \
|
||||
-e "DB_TYPE=postgres" -e "DB_HOST=192.168.1.100" -e "DB_NAME=gitlabhq_production" -e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
#### Linking to PostgreSQL Container
|
||||
@ -344,7 +344,7 @@ docker run --name=gitlab -i -t --rm --link postgresql:postgresql \
|
||||
-e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-e "DB_NAME=gitlabhq_production" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:setup
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:setup
|
||||
```
|
||||
|
||||
**NOTE: The above setup is performed only for the first run**.
|
||||
@ -356,7 +356,7 @@ docker run --name=gitlab -d --link postgresql:postgresql \
|
||||
-e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-e "DB_NAME=gitlabhq_production" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
## Redis
|
||||
@ -382,7 +382,7 @@ The image can be configured to use an external redis server instead of starting
|
||||
```bash
|
||||
docker run --name=gitlab -i -t --rm \
|
||||
-e "REDIS_HOST=192.168.1.100" -e "REDIS_PORT=6379" \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
### Linking to Redis Container
|
||||
You can link this image with a redis container to satisfy gitlab's redis requirement. The alias of the redis server container should be set to **redisio** while linking with the gitlab image.
|
||||
@ -403,7 +403,7 @@ We are now ready to start the GitLab application.
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -d --link redis:redisio \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
### Mail
|
||||
@ -423,7 +423,7 @@ The following environment variables need to be specified to get mail support to
|
||||
docker run --name=gitlab -d \
|
||||
-e "SMTP_USER=USER@gmail.com" -e "SMTP_PASS=PASSWORD" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
### SSL
|
||||
@ -488,7 +488,7 @@ HTTPS support can be enabled by setting the GITLAB_HTTPS option to true. Additio
|
||||
docker run --name=gitlab -d \
|
||||
-e "GITLAB_HTTPS=true" -e "SSL_SELF_SIGNED=true" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
In this configuration, any requests made over the plain http protocol will automatically be redirected to use the https protocol. However, this is not optimal when using a load balancer.
|
||||
@ -506,7 +506,7 @@ docker run --name=gitlab -d \
|
||||
-e "GITLAB_HTTPS=true" -e "SSL_SELF_SIGNED=true" \
|
||||
-e "GITLAB_HTTPS_ONLY=false" \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
Again, drop the ```-e "SSL_SELF_SIGNED=true"``` option if you are using CA certified SSL certificates.
|
||||
@ -546,7 +546,7 @@ docker run --name=gitlab -d -h git.local.host \
|
||||
-v /opt/gitlab/mysql:/var/lib/mysql \
|
||||
-e "GITLAB_HOST=git.local.host" -e "GITLAB_EMAIL=gitlab@local.host" -e "GITLAB_SUPPORT=support@local.host" \
|
||||
-e "SMTP_USER=USER@gmail.com" -e "SMTP_PASS=PASSWORD" \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
If you are using an external mysql database
|
||||
@ -557,7 +557,7 @@ docker run --name=gitlab -d -h git.local.host \
|
||||
-e "DB_HOST=192.168.1.100" -e "DB_NAME=gitlabhq_production" -e "DB_USER=gitlab" -e "DB_PASS=password" \
|
||||
-e "GITLAB_HOST=git.local.host" -e "GITLAB_EMAIL=gitlab@local.host" -e "GITLAB_SUPPORT=support@local.host" \
|
||||
-e "SMTP_USER=USER@gmail.com" -e "SMTP_PASS=PASSWORD" \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
### Run under sub URI
|
||||
@ -568,7 +568,7 @@ The path should start with slash, and should not have any trailing slashes.
|
||||
docker run --name=gitlab -d \
|
||||
-v /opt/gitlab/data:/home/git/data \
|
||||
-e "GITLAB_RELATIVE_URL_ROOT=/gitlab" \
|
||||
sameersbn/gitlab:6.9.2
|
||||
sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
When you change the sub URI path, you need to recompile all precompiled assets. This can be done with either deleting tmp/cache/VERSION file under data store, or just `rm -Rf /PATH/TO/DATA_STORE/tmp`. After cleaning up cache files, restart the container.
|
||||
@ -654,7 +654,7 @@ To take a backup all you need to do is run the gitlab rake task to create a back
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -i -t --rm [OPTIONS] \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:backup:create
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:backup:create
|
||||
```
|
||||
|
||||
A backup will be created in the backups folder of the [Data Store](#data-store)
|
||||
@ -671,7 +671,7 @@ To restore a backup, run the image in interactive (-i -t) mode and pass the "app
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -i -t --rm [OPTIONS] \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:backup:restore
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:backup:restore
|
||||
```
|
||||
|
||||
The restore operation will list all available backups in reverse chronological order. Select the backup you want to restore and gitlab will do its job.
|
||||
@ -693,7 +693,7 @@ To upgrade to newer gitlab releases, simply follow this 4 step upgrade procedure
|
||||
- **Step 1**: Update the docker image.
|
||||
|
||||
```bash
|
||||
docker pull sameersbn/gitlab:6.9.2
|
||||
docker pull sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
- **Step 2**: Stop the currently running image
|
||||
@ -706,13 +706,13 @@ docker stop gitlab
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -i -t --rm [OPTIONS] \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:backup:create
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:backup:create
|
||||
```
|
||||
|
||||
- **Step 4**: Start the image
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -d [OPTIONS] sameersbn/gitlab:6.9.2
|
||||
docker run --name=gitlab -d [OPTIONS] sameersbn/gitlab:7.0.0
|
||||
```
|
||||
|
||||
## Rake Tasks
|
||||
@ -721,14 +721,14 @@ The app:rake command allows you to run gitlab rake tasks. To run a rake task sim
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -d [OPTIONS] \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:env:info
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:env:info
|
||||
```
|
||||
|
||||
Similarly, to import bare repositories into GitLab project instance
|
||||
|
||||
```bash
|
||||
docker run --name=gitlab -d [OPTIONS] \
|
||||
sameersbn/gitlab:6.9.2 app:rake gitlab:import:repos
|
||||
sameersbn/gitlab:7.0.0 app:rake gitlab:import:repos
|
||||
```
|
||||
|
||||
For a complete list of available rake tasks please refer https://github.com/gitlabhq/gitlabhq/tree/master/doc/raketasks or the help section of your gitlab installation.
|
||||
|
||||
@ -34,6 +34,20 @@ listen "/home/git/gitlab/tmp/sockets/gitlab.socket", :backlog => 64
|
||||
listen "127.0.0.1:8080", :tcp_nopush => true
|
||||
|
||||
# nuke workers after 30 seconds instead of 60 seconds (the default)
|
||||
#
|
||||
# NOTICE: git push over http depends on this value.
|
||||
# If you want be able to push huge amount of data to git repository over http
|
||||
# you will have to increase this value too.
|
||||
#
|
||||
# Example of output if you try to push 1GB repo to GitLab over http.
|
||||
# -> git push http://gitlab.... master
|
||||
#
|
||||
# error: RPC failed; result=18, HTTP code = 200
|
||||
# fatal: The remote end hung up unexpectedly
|
||||
# fatal: The remote end hung up unexpectedly
|
||||
#
|
||||
# For more information see http://stackoverflow.com/a/21682112/752049
|
||||
#
|
||||
timeout {{UNICORN_TIMEOUT}}
|
||||
|
||||
# feel free to point this anywhere accessible on the filesystem
|
||||
|
||||
@ -55,6 +55,7 @@ server {
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://gitlab;
|
||||
}
|
||||
|
||||
@ -1,26 +1,66 @@
|
||||
# GITLAB
|
||||
# Maintainer: @randx
|
||||
|
||||
# CHUNKED TRANSFER
|
||||
# It is a known issue that Git-over-HTTP requires chunked transfer encoding [0] which is not
|
||||
# supported by Nginx < 1.3.9 [1]. As a result, pushing a large object with Git (i.e. a single large file)
|
||||
# can lead to a 411 error. In theory you can get around this by tweaking this configuration file and either
|
||||
# - installing an old version of Nginx with the chunkin module [2] compiled in, or
|
||||
# - using a newer version of Nginx.
|
||||
#
|
||||
# At the time of writing we do not know if either of these theoretical solutions works. As a workaround
|
||||
# users can use Git over SSH to push large files.
|
||||
#
|
||||
# [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
|
||||
# [1] https://github.com/agentzh/chunkin-nginx-module#status
|
||||
# [2] https://github.com/agentzh/chunkin-nginx-module
|
||||
## GitLab
|
||||
## Contributors: randx, yin8086, sashkab, orkoden, axilleas
|
||||
##
|
||||
## Modified from nginx http version
|
||||
## Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
|
||||
##
|
||||
## Lines starting with two hashes (##) are comments containing information
|
||||
## for configuration. One hash (#) comments are actual configuration parameters
|
||||
## which you can comment/uncomment to your liking.
|
||||
##
|
||||
###################################
|
||||
## SSL configuration ##
|
||||
###################################
|
||||
##
|
||||
## Optimal configuration is taken from:
|
||||
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
||||
## Make sure to read it and understand what each option does.
|
||||
##
|
||||
## [Optional] Generate a self-signed ssl certificate:
|
||||
## mkdir /etc/nginx/ssl/
|
||||
## cd /etc/nginx/ssl/
|
||||
## sudo openssl req -newkey rsa:2048 -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
|
||||
## sudo chmod o-r gitlab.key
|
||||
##
|
||||
## Edit `gitlab-shell/config.yml`:
|
||||
## 1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
|
||||
## 2) Set "ca_file" to `/etc/nginx/ssl/gitlab.crt`
|
||||
## 3) Set "self_signed_cert" to `true`
|
||||
## Edit `gitlab/config/gitlab.yml`:
|
||||
## 1) Define port for http "port: 443"
|
||||
## 2) Enable https "https: true"
|
||||
## 3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"
|
||||
##
|
||||
##################################
|
||||
## CHUNKED TRANSFER ##
|
||||
##################################
|
||||
##
|
||||
## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0]
|
||||
## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object
|
||||
## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get
|
||||
## around this by tweaking this configuration file and either:
|
||||
## - installing an old version of Nginx with the chunkin module [2] compiled in, or
|
||||
## - using a newer version of Nginx.
|
||||
##
|
||||
## At the time of writing we do not know if either of these theoretical solutions works. As a workaround
|
||||
## users can use Git over SSH to push large files.
|
||||
##
|
||||
## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
|
||||
## [1] https://github.com/agentzh/chunkin-nginx-module#status
|
||||
## [2] https://github.com/agentzh/chunkin-nginx-module
|
||||
|
||||
upstream gitlab {
|
||||
|
||||
## Uncomment if you have set up unicorn to listen on a unix socket (recommended).
|
||||
server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
|
||||
|
||||
## Uncomment if unicorn is configured to listen on a tcp port.
|
||||
## Check the port number in /home/git/gitlab/config/unicorn.rb
|
||||
# server 127.0.0.1:8080;
|
||||
}
|
||||
|
||||
server {
|
||||
listen *:80; # e.g., listen 192.168.1.1:80; In most cases *:80 is a good idea
|
||||
listen 80; # e.g., listen 192.168.1.1:80; In most cases *:80 is a good idea
|
||||
server_name {{YOUR_SERVER_FQDN}}; # e.g., server_name source.example.com;
|
||||
server_tokens off; # don't show the version number, a security best practice
|
||||
root /dev/null;
|
||||
@ -72,59 +112,87 @@ server {
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
## Replace git.example.com with your FQDN.
|
||||
server_name {{YOUR_SERVER_FQDN}};
|
||||
server_tokens off;
|
||||
root /dev/null;
|
||||
|
||||
ssl on;
|
||||
ssl_certificate {{SSL_CERTIFICATE_PATH}};
|
||||
ssl_certificate_key {{SSL_KEY_PATH}};
|
||||
ssl_protocols SSLv3 TLSv1 TLSv1.2;
|
||||
|
||||
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
## Increase this if you want to upload large attachments
|
||||
## Or if you want to accept large git objects over http
|
||||
client_max_body_size {{NGINX_MAX_UPLOAD_SIZE}};
|
||||
|
||||
## Strong SSL Security
|
||||
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
||||
ssl on;
|
||||
ssl_certificate {{SSL_CERTIFICATE_PATH}};
|
||||
ssl_certificate_key {{SSL_KEY_PATH}};
|
||||
|
||||
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
## Enable OCSP stapling to reduce the overhead and latency of running SSL.
|
||||
## Replace with your ssl_trusted_certificate. For more info see:
|
||||
## - https://medium.com/devops-programming/4445f4862461
|
||||
## - https://www.ruby-forum.com/topic/4419319
|
||||
# ssl_stapling on;
|
||||
# ssl_stapling_verify on;
|
||||
# ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
|
||||
# resolver 208.67.222.222 208.67.222.220 valid=300s;
|
||||
# resolver_timeout 10s;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
## [Optional] Generate a stronger DHE parameter (recommended):
|
||||
## cd /etc/ssl/certs
|
||||
## openssl dhparam -out dhparam.pem 2048
|
||||
##
|
||||
ssl_dhparam {{SSL_DHPARAM_PATH}};
|
||||
|
||||
# Increase this if you want to upload large attachments
|
||||
# Or if you want to accept large git objects over http
|
||||
client_max_body_size {{NGINX_MAX_UPLOAD_SIZE}};
|
||||
add_header Strict-Transport-Security max-age=63072000;
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
|
||||
# individual nginx logs for this gitlab vhost
|
||||
## Individual nginx logs for this GitLab vhost
|
||||
access_log /var/log/nginx/gitlab_access.log;
|
||||
error_log /var/log/nginx/gitlab_error.log;
|
||||
|
||||
location {{GITLAB_RELATIVE_URL_ROOT}}/ {
|
||||
root /home/git/gitlab/public;
|
||||
# serve static files from defined root folder;.
|
||||
# @gitlab is a named location for the upstream fallback, see below
|
||||
## Serve static files from defined root folder.
|
||||
## @gitlab is a named location for the upstream fallback, see below.
|
||||
try_files $uri $uri/index.html $uri.html @gitlab;
|
||||
}
|
||||
|
||||
# if a file, which is not found in the root folder is requested,
|
||||
# then the proxy pass the request to the upsteam (gitlab unicorn)
|
||||
## If a file, which is not found in the root folder is requested,
|
||||
## then the proxy pass the request to the upsteam (gitlab unicorn).
|
||||
location @gitlab {
|
||||
# If you use https make sure you disable gzip compression
|
||||
# to be safe against BREACH attack
|
||||
|
||||
## If you use https make sure you disable gzip compression
|
||||
## to be safe against BREACH attack.
|
||||
gzip off;
|
||||
|
||||
proxy_read_timeout 300; # Some requests take more than 30 seconds.
|
||||
proxy_connect_timeout 300; # Some requests take more than 30 seconds.
|
||||
proxy_redirect off;
|
||||
## https://github.com/gitlabhq/gitlabhq/issues/694
|
||||
## Some requests take more than 30 seconds.
|
||||
proxy_read_timeout 300;
|
||||
proxy_connect_timeout 300;
|
||||
proxy_redirect off;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://gitlab;
|
||||
}
|
||||
|
||||
# Enable gzip compression as per rails guide: http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
|
||||
## Enable gzip compression as per rails guide:
|
||||
## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
|
||||
## WARNING: If you are using relative urls do remove the block below
|
||||
## See config/application.rb under "Relative url support" for the list of
|
||||
## other files that need to be changed for relative url support
|
||||
location ~ ^{{GITLAB_RELATIVE_URL_ROOT}}/assets/(.*) {
|
||||
alias /home/git/gitlab/public/assets/$1;
|
||||
gzip_static on; # to serve pre-gzipped version
|
||||
|
||||
@ -1,86 +1,159 @@
|
||||
# GITLAB
|
||||
# Maintainer: @randx
|
||||
## GitLab
|
||||
## Contributors: randx, yin8086, sashkab, orkoden, axilleas
|
||||
##
|
||||
## Modified from nginx http version
|
||||
## Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
|
||||
##
|
||||
## Lines starting with two hashes (##) are comments containing information
|
||||
## for configuration. One hash (#) comments are actual configuration parameters
|
||||
## which you can comment/uncomment to your liking.
|
||||
##
|
||||
###################################
|
||||
## SSL configuration ##
|
||||
###################################
|
||||
##
|
||||
## Optimal configuration is taken from:
|
||||
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
||||
## Make sure to read it and understand what each option does.
|
||||
##
|
||||
## [Optional] Generate a self-signed ssl certificate:
|
||||
## mkdir /etc/nginx/ssl/
|
||||
## cd /etc/nginx/ssl/
|
||||
## sudo openssl req -newkey rsa:2048 -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
|
||||
## sudo chmod o-r gitlab.key
|
||||
##
|
||||
## Edit `gitlab-shell/config.yml`:
|
||||
## 1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
|
||||
## 2) Set "ca_file" to `/etc/nginx/ssl/gitlab.crt`
|
||||
## 3) Set "self_signed_cert" to `true`
|
||||
## Edit `gitlab/config/gitlab.yml`:
|
||||
## 1) Define port for http "port: 443"
|
||||
## 2) Enable https "https: true"
|
||||
## 3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"
|
||||
##
|
||||
##################################
|
||||
## CHUNKED TRANSFER ##
|
||||
##################################
|
||||
##
|
||||
## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0]
|
||||
## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object
|
||||
## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get
|
||||
## around this by tweaking this configuration file and either:
|
||||
## - installing an old version of Nginx with the chunkin module [2] compiled in, or
|
||||
## - using a newer version of Nginx.
|
||||
##
|
||||
## At the time of writing we do not know if either of these theoretical solutions works. As a workaround
|
||||
## users can use Git over SSH to push large files.
|
||||
##
|
||||
## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
|
||||
## [1] https://github.com/agentzh/chunkin-nginx-module#status
|
||||
## [2] https://github.com/agentzh/chunkin-nginx-module
|
||||
|
||||
# CHUNKED TRANSFER
|
||||
# It is a known issue that Git-over-HTTP requires chunked transfer encoding [0] which is not
|
||||
# supported by Nginx < 1.3.9 [1]. As a result, pushing a large object with Git (i.e. a single large file)
|
||||
# can lead to a 411 error. In theory you can get around this by tweaking this configuration file and either
|
||||
# - installing an old version of Nginx with the chunkin module [2] compiled in, or
|
||||
# - using a newer version of Nginx.
|
||||
#
|
||||
# At the time of writing we do not know if either of these theoretical solutions works. As a workaround
|
||||
# users can use Git over SSH to push large files.
|
||||
#
|
||||
# [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
|
||||
# [1] https://github.com/agentzh/chunkin-nginx-module#status
|
||||
# [2] https://github.com/agentzh/chunkin-nginx-module
|
||||
|
||||
upstream gitlab {
|
||||
|
||||
## Uncomment if you have set up unicorn to listen on a unix socket (recommended).
|
||||
server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
|
||||
|
||||
## Uncomment if unicorn is configured to listen on a tcp port.
|
||||
## Check the port number in /home/git/gitlab/config/unicorn.rb
|
||||
# server 127.0.0.1:8080;
|
||||
}
|
||||
|
||||
## This is a normal HTTP host which redirects all traffic to the HTTPS host.
|
||||
server {
|
||||
listen *:80;
|
||||
## Replace git.example.com with your FQDN.
|
||||
server_name _;
|
||||
server_tokens off;
|
||||
## root doesn't have to be a valid path since we are redirecting
|
||||
root /nowhere;
|
||||
rewrite ^ https://$host:{{GITLAB_PORT}}$request_uri? permanent;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
## Replace git.example.com with your FQDN.
|
||||
server_name {{YOUR_SERVER_FQDN}};
|
||||
server_tokens off;
|
||||
root /dev/null;
|
||||
|
||||
ssl on;
|
||||
ssl_certificate {{SSL_CERTIFICATE_PATH}};
|
||||
ssl_certificate_key {{SSL_KEY_PATH}};
|
||||
ssl_protocols SSLv3 TLSv1 TLSv1.2;
|
||||
|
||||
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
## Increase this if you want to upload large attachments
|
||||
## Or if you want to accept large git objects over http
|
||||
client_max_body_size {{NGINX_MAX_UPLOAD_SIZE}};
|
||||
|
||||
## Strong SSL Security
|
||||
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
||||
ssl on;
|
||||
ssl_certificate {{SSL_CERTIFICATE_PATH}};
|
||||
ssl_certificate_key {{SSL_KEY_PATH}};
|
||||
|
||||
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
## Enable OCSP stapling to reduce the overhead and latency of running SSL.
|
||||
## Replace with your ssl_trusted_certificate. For more info see:
|
||||
## - https://medium.com/devops-programming/4445f4862461
|
||||
## - https://www.ruby-forum.com/topic/4419319
|
||||
# ssl_stapling on;
|
||||
# ssl_stapling_verify on;
|
||||
# ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
|
||||
# resolver 208.67.222.222 208.67.222.220 valid=300s;
|
||||
# resolver_timeout 10s;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
## [Optional] Generate a stronger DHE parameter (recommended):
|
||||
## cd /etc/ssl/certs
|
||||
## openssl dhparam -out dhparam.pem 2048
|
||||
##
|
||||
ssl_dhparam {{SSL_DHPARAM_PATH}};
|
||||
|
||||
# Increase this if you want to upload large attachments
|
||||
# Or if you want to accept large git objects over http
|
||||
client_max_body_size {{NGINX_MAX_UPLOAD_SIZE}};
|
||||
add_header Strict-Transport-Security max-age=63072000;
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
|
||||
# individual nginx logs for this gitlab vhost
|
||||
## Individual nginx logs for this GitLab vhost
|
||||
access_log /var/log/nginx/gitlab_access.log;
|
||||
error_log /var/log/nginx/gitlab_error.log;
|
||||
|
||||
location {{GITLAB_RELATIVE_URL_ROOT}}/ {
|
||||
root /home/git/gitlab/public;
|
||||
# serve static files from defined root folder;.
|
||||
# @gitlab is a named location for the upstream fallback, see below
|
||||
## Serve static files from defined root folder.
|
||||
## @gitlab is a named location for the upstream fallback, see below.
|
||||
try_files $uri $uri/index.html $uri.html @gitlab;
|
||||
}
|
||||
|
||||
# if a file, which is not found in the root folder is requested,
|
||||
# then the proxy pass the request to the upsteam (gitlab unicorn)
|
||||
## If a file, which is not found in the root folder is requested,
|
||||
## then the proxy pass the request to the upsteam (gitlab unicorn).
|
||||
location @gitlab {
|
||||
# If you use https make sure you disable gzip compression
|
||||
# to be safe against BREACH attack
|
||||
|
||||
## If you use https make sure you disable gzip compression
|
||||
## to be safe against BREACH attack.
|
||||
gzip off;
|
||||
|
||||
proxy_read_timeout 300; # Some requests take more than 30 seconds.
|
||||
proxy_connect_timeout 300; # Some requests take more than 30 seconds.
|
||||
proxy_redirect off;
|
||||
## https://github.com/gitlabhq/gitlabhq/issues/694
|
||||
## Some requests take more than 30 seconds.
|
||||
proxy_read_timeout 300;
|
||||
proxy_connect_timeout 300;
|
||||
proxy_redirect off;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://gitlab;
|
||||
}
|
||||
|
||||
# Enable gzip compression as per rails guide: http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
|
||||
## Enable gzip compression as per rails guide:
|
||||
## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
|
||||
## WARNING: If you are using relative urls do remove the block below
|
||||
## See config/application.rb under "Relative url support" for the list of
|
||||
## other files that need to be changed for relative url support
|
||||
location ~ ^{{GITLAB_RELATIVE_URL_ROOT}}/assets/(.*) {
|
||||
alias /home/git/gitlab/public/assets/$1;
|
||||
gzip_static on; # to serve pre-gzipped version
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
GITLAB_VERSION=6.9.2
|
||||
GITLAB_VERSION=7.0.0
|
||||
SHELL_VERSION=1.9.6
|
||||
|
||||
# remove the host keys generated during openssh-server installation
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user