gitlab ce 配置 （去除 自带的 nginx ，与原有的 nginx 组合使用）

gitlab 安装步骤：省略，（网上很多，不详说）

nginx 安装步骤：同上

 

该配置为本人实际操作所得，虽然参考了很多网上的文章，但最终还是自己结合众多文章得到的最后结果，以下直接上相关配置信息

 

配置gitlab

【/etc/gitlab/gitlab.rb】

#vi /etc/gitlab/gitlab.rb

#访问域名，域名请换成自己的实际域名
external_url 'https://gitlab.DOMAIN.COM'

gitlab_rails['trusted_proxies'] = ['127.0.0.1']

#gitlab 数据存放位置
git_data_dir "/data/gitlab"

#gitlab 附件上传位置
gitlab_rails['uploads_directory'] = "/data/gitlab/uploads"

#gitlab 环境协议及访问地址
#【特别提示】该地址将用在nginx 的 upstream 配置中，很重要，网上示例大多都写成了 server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;，实际使用会一直返回 nginx 的 502 Bad Gateway 错误，千万注意
gitlab_workhorse['listen_network'] = "tcp"
gitlab_workhorse['listen_addr'] = "127.0.0.1:8085"

#gitlab 监听地址及端口
unicorn['listen'] = '127.0.0.1'
unicorn['port'] = 8086

#扩展WEB服务（指现有nginx的）的LINUX启动用户，请根据实际环境配置
web_server['external_users'] = ['www']

#关闭自带nginx
nginx['enable'] = false

【/var/opt/gitlab/gitlab-rails/etc/unicorn.rb/unicorn.rb】

#vi /var/opt/gitlab/gitlab-rails/etc/unicorn.rb/unicorn.rb

#该地址与 gitlab.rb 中的unicorn中的需要一致哦
listen "127.0.0.1:8086", :tcp_nopush => true
listen "/var/opt/gitlab/gitlab-rails/sockets/gitlab.socket", :backlog => 1024

该处配置完成后，记得一定要生效配置信息 gitlab-ctl reconfigure ，否则无法生效哦

 

配置 nginx host

#vi /usr/local/nginx/conf/vhost/gitlab.DOMAIN.COM.conf


upstream gitlab-workhorse {
  #该处与gitlab 中的 gitlab_workhorse 一致
  server 127.0.0.1:8085;
}

#HTTP 站点
server {
  listen 0.0.0.0:80;
  #listen [::]:80 ipv6only=on default_server;
  server_name gitlab.DOMAIN.COM;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$http_host$request_uri;
  access_log  /usr/local/nginx/logs/gitlab_access.log;
  error_log   /usr/local/nginx/logs/gitlab_error.log;
}

#HTTPS 站点
server {
  listen 0.0.0.0:443 ssl;
  #listen [::]:443 ipv6only=on ssl default_server;
  server_name gitlab.DOMAIN.COM;
  server_tokens off;
  root /opt/gitlab/embedded/service/gitlab-rails/public;

  ssl on;
  #https 证书设置
  ssl_certificate /usr/local/nginx/conf/ssl/certs.pem;
  ssl_certificate_key /usr/local/nginx/conf/ssl/certs_private.key;

  ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 5m;

  access_log  /usr/local/nginx/logs/gitlab_access.log;
  error_log   /usr/local/nginx/logs/gitlab_error.log;

  location / {
    client_max_body_size 0;
    gzip off;

    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_http_version 1.1;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_pass http://gitlab-workhorse;
  }
}

注意事项，两个端口一定要注意是否配置正确，否则就会出现 502的问题的

还有一个重要的，就是 nginx 配置中的 upstream server 地址 直接配成 gitlab.rb中的  gitlab_workhorse['listen_addr'] 地址，不需要像网上大家提供的官方的 server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;

 

【参考文章】

GitLab+本地Nginx（两步奏）：https://blog.csdn.net/qq_34894188/article/details/80468889

CentOS 7.x上GitLab搭建详细教程：https://www.linuxidc.com/Linux/2017-12/149766.htm

【资源链接】

gitlab-ce 清华镜像：https://mirror.tuna.tsinghua.edu.cn/help/gitlab-ce/

gitlab 中文社区：https://gitlab.com/xhang/gitlab/wikis/home