CentOS7.6.下使用Gitlab官方Docker镜像安装并配置Https支持

环境:

Author: dusuanyun

Date: 2019-03-16

OS: CentOS7.6

Docker: 18.09.0

gitlab-ce: 11.8.2-ce.0 在2019-03-16最新版,中文化比之前版本好很多!

 

相关文档:

官方Docker说明:https://hub.docker.com/r/gitlab/gitlab-ce

官网的说明:https://docs.gitlab.com/omnibus/docker/

启用SSL的HTTPS:https://docs.gitlab.com/omnibus/settings/nginx.html#enable-https

 

1.创建目录以便docker容器进行挂载:

例如:home/data/Gitlab/

2.下载gitlab/gitlab-ce:11.8.2-ce.0版本镜像并运行:

docker run --detach \

--hostname gitlab \

--publish 10443:443 --publish 10080:80 --publish 10022:22 \

--name iGitlab \

--restart always \

--volume /home/data/Gitlab/config:/etc/gitlab \

--volume /home/data/Gitlab/logs:/var/log/gitlab \

--volume /home/data/Gitlab/data:/var/opt/gitlab \

gitlab/gitlab-ce:11.8.2-ce.0

命令运行后,自动创建config logs data目录.

本文档中所有docker命令没有使用sudo前缀,是因为配置了当前用户可以直接运行,如果你没有配置过则需要加sudo.

命令说明:

--name 是指创建的容器的名称;

--hostname 是指容器里面的主机名;

--publish 将宿主机的端口10443/10080/10022分别映射到容器内主机的443/80/22端口

运行成功后:访问http://宿主机的IP:10080/ 即可看到web界面,并提示修改root密码

首次启动较慢,大约3-4分钟!

3.创建自签名的证书: 将下面的内容保存为shell运行,按照提示输入即可!

#!/bin/sh

# create self-signed server certificate:

read -p "Enter your hostname or IP : " DOMAIN

echo "Create server key..."

openssl genrsa -des3 -out $DOMAIN.key 1024

echo "Create server certificate signing request..."

SUBJECT="/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=$DOMAIN"

openssl req -new -subj $SUBJECT -key $DOMAIN.key -out $DOMAIN.csr

echo "Remove password..."

mv $DOMAIN.key $DOMAIN.origin.key

openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key

echo "Sign SSL certificate..."

openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt

echo "TODO:"

echo "Copy $DOMAIN.crt to /home/data/Gitlab/config/ssl/$DOMAIN.crt"

echo "Copy $DOMAIN.key to /home/data/Gitlab/config/ssl/$DOMAIN.key"

echo "Add nginx configuration in /home/data/Gitlab/config/gitlab.rb"

参考地址: https://www.cnblogs.com/xieshuang/p/8488458.html

4.配置gitlab启用https:

A.先在config目录下创建ssl目录存放证书:

cd /home/data/Gitlab/config

mkdir ssl

B.将创建的证书拷贝到ssl目录下:

[root@sorter ssl]# pwd

/home/data/Gitlab/config/ssl

[root@sorter ssl]# ls -al

总用量 16

drwx------. 2 root root 85 3月 15 20:08 .

drwxrwxr-x. 4 root root 250 3月 15 20:52 ..

-rwx------. 1 root root 863 3月 15 20:05 server.crt

-rwx------. 1 root root 655 3月 15 20:05 server.csr

-rwx------. 1 root root 887 3月 15 20:05 server.key

-rwx------. 1 root root 963 3月 15 20:05 server.origin.key

红色部分为必须的,我是把生成的全部文件都拷贝过来了!

C.配置gitlab.rb文件

[root@sorter config]# vim /home/data/Gitlab/config/gitlab.rb

配置的地方如下: 下面的行首数字为行号

11 ##! For more details on configuring external_url see:

12 ##! https://docs.gitlab.com/omnibus/settings/configuration.html#configuring-the-external-url-for-gitlab

13 external_url 'https://192.168.1.141:10443'

980 # nginx['enable'] = true

981 # nginx['client_max_body_size'] = '250m'

982 nginx['redirect_http_to_https'] = true

983 nginx['redirect_http_to_https_port'] = 80

994 nginx['ssl_certificate'] = "/etc/gitlab/ssl/server.crt"

995 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/server.key"

996 # nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"

1021 ##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#setting-the-nginx-listen-port

1022 nginx['listen_port'] = 443

1031 # nginx['proxy_connect_timeout'] = 300

1032 nginx['proxy_set_headers'] = {

1033 "Host" => "$http_host_with_default",

1034 "X-Real-IP" => "$remote_addr",

1035 "X-Forwarded-For" => "$proxy_add_x_forwarded_for",

1036 "X-Forwarded-Proto" => "https",

1037 "X-Forwarded-Ssl" => "on",

1038 "Upgrade" => "$http_upgrade",

1039 "Connection" => "$connection_upgrade"

1040 }

1041 # nginx['proxy_cache_path'] = 'proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2'

1046 # nginx['real_ip_recursive'] = nil

1047 nginx['custom_error_pages'] = {

1048 '404' => {

1049 'title' => 'Example title',

1050 'header' => 'Example header',

1051 'message' => 'Example message'

1052 }

1053 }

配置说明:

192.168.1.141 是宿主机器的IP地址.

13行:IP地址是宿主机器的IP地址不是容器内主机的IP,10443端口也是宿主机端口;

982行:配置http自动跳转到https协议的地址;

983行:80端口是容器内的端口,如果不配配置http://宿主IP:10080/将不可访问;

994-995行:配置创建的自签名证书;

1022行:配置监听容器内的443端口,注意不是外面主机的10443端口,我刚开始搞错了,死活不通!

1032-1040与1047-1053行,应该是可以不配置的,不过我没有测试.

D.让配置生效:

进入容器内部:

docker exec -it iGitlab bash

在容器内执行:

gitlab-ctl hup nginx

gitlab-ctl reconfigure

5.至此:

可以正常访问:https://主机IP:10443/

访问:http://主机IP:10080/会自动跳转到https://主机IP:10443/

6.如何使用gitlab,自己百度即可!