centos7.6.使用 docker 安装 gitlab 支持 https

环境:

Date: 2019-06-15

OS: CentOS7.6.1810

Docker: 18.09.6

gitlab-ce: gitlab/gitlab-ce:11.11.3-ce.0

 

相关文档:

官方Docker说明:https://hub.docker.com/r/gitlab/gitlab-ce

官网的说明:https://docs.gitlab.com/omnibus/docker/

启用SSL的HTTPS:https://docs.gitlab.com/omnibus/settings/nginx.html#enable-https

 

1.创建目录以便docker容器进行挂载:

例如: /home/gitlab/data

 

2.下载 gitlab/gitlab-ce:11.11.3-ce.0 版本镜像并运行:

docker run --detach \
    --hostname gitlab \
    --publish 10443:443 --publish 10080:80 --publish 10022:22 \
    --name myGitlab \
    --restart always \
    --volume /home/gitlab/data/config:/etc/gitlab \
    --volume /home/gitlab/data/logs:/var/log/gitlab \
    --volume /home/gitlab/data/data:/var/opt/gitlab \
    gitlab/gitlab-ce:11.11.3-ce.0

命令运行后,自动创建config logs data目录.

本文档中所有docker命令没有使用sudo前缀,是因为配置了当前用户可以直接运行,如果你没有配置过则需要加sudo.

命令说明:

--name 是指创建的容器的名称;

--hostname 是指容器里面的主机名;

--publish 将宿主机的端口10443/10080/10022分别映射到容器内主机的443/80/22端口

运行成功后:访问http://宿主机的IP:10080/ 即可看到web界面,并提示修改root密码

首次启动较慢,大约3-4分钟!

 

3.创建自签名的证书:

将下面的内容保存为shell运行,按照提示输入即可!

#!/bin/sh

# create self-signed server certificate:

read -p "Enter your hostname or IP : " DOMAIN

echo "Create server key..."

openssl genrsa -des3 -out $DOMAIN.key 1024

echo "Create server certificate signing request..."

SUBJECT="/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=$DOMAIN"

openssl req -new -subj $SUBJECT -key $DOMAIN.key -out $DOMAIN.csr

echo "Remove password..."

mv $DOMAIN.key $DOMAIN.origin.key

openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key

echo "Sign SSL certificate..."

openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt

echo "TODO:"

echo "Copy $DOMAIN.crt to /home/data/Gitlab/config/ssl/$DOMAIN.crt"

echo "Copy $DOMAIN.key to /home/data/Gitlab/config/ssl/$DOMAIN.key"

echo "Add nginx configuration in /home/data/Gitlab/config/gitlab.rb"

上面我的实际操作:

我在 /home/allen/Documents/gitlab 目录下创建脚本 gensshkey.sh,并将上面脚本复制到里面,然后通过sh gensshkey.sh执行

要求输入域名 domain: register.allen.com

要求输入密码: 自行输入,至少需要4位

参考地址: https://www.cnblogs.com/xieshuang/p/8488458.html

 

4.配置gitlab启用https:

A.先在config目录下创建ssl目录存放证书:

cd /home/data/Gitlab/config

mkdir ssl

B.将创建的证书拷贝到ssl目录下:

[root@registry /home/gitlab/data/config/ssl]$ls -ltr
total 16
-rw-r--r--. 1 root root 895 Jun 15 10:42 registry.allen.com.crt
-rw-r--r--. 1 root root 887 Jun 15 10:42 registry.allen.com.key
-rw-r--r--. 1 root root 963 Jun 15 10:43 registry.allen.com.origin.key
-rw-r--r--. 1 root root 672 Jun 15 10:43 registry.allen.com.csr

crt和key文件是必须的,我是把生成的全部文件都拷贝过来了!

C.配置gitlab.rb文件

[root@registry /home/gitlab/data/config]$vi gitlab.rb

配置的地方如下: 下面的行首数字为行号

11 ##! For more details on configuring external_url see:

12 ##! https://docs.gitlab.com/omnibus/settings/configuration.html#configuring-the-external-url-for-gitlab

13 external_url 'https://192.168.58.129:10443'

980 # nginx['enable'] = true

981 # nginx['client_max_body_size'] = '250m'

982 nginx['redirect_http_to_https'] = true

983 nginx['redirect_http_to_https_port'] = 80

994 nginx['ssl_certificate'] = "/etc/gitlab/ssl/registry.allen.com.crt"

995 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/registry.allen.com.key"

996 # nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"

1021 ##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#setting-the-nginx-listen-port

1022 nginx['listen_port'] = 443

1031 # nginx['proxy_connect_timeout'] = 300

1032 nginx['proxy_set_headers'] = {

1033 "Host" => "$http_host_with_default",

1034 "X-Real-IP" => "$remote_addr",

1035 "X-Forwarded-For" => "$proxy_add_x_forwarded_for",

1036 "X-Forwarded-Proto" => "https",

1037 "X-Forwarded-Ssl" => "on",

1038 "Upgrade" => "$http_upgrade",

1039 "Connection" => "$connection_upgrade"

1040 }

1041 # nginx['proxy_cache_path'] = 'proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2'

1046 # nginx['real_ip_recursive'] = nil

1047 nginx['custom_error_pages'] = {

1048 '404' => {

1049 'title' => 'Example title',

1050 'header' => 'Example header',

1051 'message' => 'Example message'

1052 }

1053 }

配置说明:

192.168.58.129 是宿主机器的IP地址.

13行:IP地址是宿主机器的IP地址不是容器内主机的IP,10443端口也是宿主机端口;

982行:配置http自动跳转到https协议的地址;

983行:80端口是容器内的端口,如果不配配置http://宿主IP:10080/将不可访问;

994-995行:配置创建的自签名证书;

1022行:配置监听容器内的443端口,注意不是外面主机的10443端口,我刚开始搞错了,死活不通!

1032-1040与1047-1053行,应该是可以不配置的,不过我没有测试.

D.让配置生效:

进入容器内部:

docker exec -it myGitlab bash

在容器内执行:

gitlab-ctl hup nginx

gitlab-ctl reconfigure

 

5.至此，可以正常访问:https://主机IP:10443/

访问:http://主机IP:10080/会自动跳转到https://主机IP:10443/

 

6.如何使用gitlab,自己百度即可!