gitlab+ldap+phpldapadmin

1. Install and configure the necessary dependencies

sudo apt-get install -y curl openssh-server ca-certificates

Next, install Postfix to send notification emails. If you want to use another solution to send emails please skip this step and configure an external SMTP server after GitLab has been installed.

sudo apt-get install -y postfix

During Postfix installation a configuration screen may appear. Select ‘Internet Site’ and press enter. Use your server’s external DNS for ‘mail name’ and press enter. If additional screens appear, continue to press enter to accept the defaults.

2. Add the GitLab package repository and install the package

Add the GitLab package repository.

curl -sS https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash

Next, install the GitLab package. Change http://gitlab.example.com to the URL at which you want to access your GitLab instance. Installation will automatically configure and start GitLab at that URL. HTTPS requires additional configuration after installation.

sudo EXTERNAL_URL="http://git.blowfire.com" apt-get install gitlab-ce

3.ERROR

安装postfix时候，遇到config.dat的报错，通过fuser 干掉它

sudo fuser -v -k /var/cache/debconf/config.dat

update的时候遇到lock

sudo rm -rf /var/cache/apt/archives/lock

sudo apt-get update

配置

域名和端口号

• 打开gitlab的默认配置文件

  sudo vim /etc/gitlab/gitlab.rb
  

• 将external_url的值设置为以下文本(这里填入自己的域名):

  external_url 'https://git.adair.com'
  

• 在/etc/hosts当中加入127.0.0.1和设置好的域名的映射

  127.0.0.1 git.adair.com
  

路径

• 配置gitlab资料备份的路径(在/etc/gitlab/gitlab.rb配置文件当中找到gitlab_rails[‘backup_path’]配置项，修改为以下文本)

  gitlab_rails['backup_path'] = "/opt/gitlab/gitlab_backup"
  

• 配置gitlab仓库存储的路径（在/etc/gitlab/gitlab.rb配置文件当中找到git_data_dirs配置项，修改为以下文本）

  git_data_dirs({"default" => "/opt/gitlab/git_data"})
  

https

• 首先确认自己使用的域名有没有https证书，如果没有的话，可以去startssl免费申请一个https证书，安装证书的方式可以参考阿里云CentOS 6.5系统LNMP环境安装SSL证书

• 申请完证书之后，建立ssl目录

  $    sudo mkdir /etc/gitlab/ssl 
  $    sudo chmod 700 /etc/gitlab/ssl
  

• 拷贝https证书到ssl目录

  $	sudo cp git.adair.com.crt git.adair.com.key /etc/gitlab/ssl/
  

• 打开gitlab的默认配置文件

  $    sudo vim /etc/gitlab/gitlab.rb
  

• 将nginx的配置设置为以下文本

  nginx['redirect_http_to_https'] = true
  nginx['ssl_certificate'] = "/etc/gitlab/ssl/gjit.adair.com.crt"
  nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/git.adair.com.key"
  

• 打开ubuntu的ufw

  $    sudo ufw allow https
  

• 这里需要使用以下命令来让配置先生效

  $    sudo gitlab-ctl reconfigure
  

• 打开gitlab的nginx的配置文件

  $    sudo vim /var/opt/gitlab/nginx/conf/gitlab-http.conf
  

• 找到443端口（https的端口）的配置，并修改为以下的格式：

  listen *:443 default_server;
  ssl on;
  ssl_certificate /etc/gitlab/ssl/git.adair.com.crt;
  ssl_certificate_key /etc/gitlab/ssl/git.adair.com.key;
  ssl_protocols SSLv3 TLSv1;
  ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
  

• 接着再创建一个/var/opt/gitlab/nginx/conf/index.conf文件用来HTTP跳转HTTPS

  server {
      listen *:80;
      server_name git.adair.com;
      rewrite ^(.*)$  https://$host$1 permanent;
  }
  

• 最后修改/var/opt/gitlab/nginx/conf/nginx.conf配置文件, 在其中加入以下内容, 来让nginx载入index.conf

  include /var/opt/gitlab/nginx/conf/index.conf;
  include /var/opt/gitlab/nginx/conf/gitlab-http.conf;
  

重启服务

配置https完成之后，使用gitlab-ctl restart来重启所有服务

$    sudo gitlab-ctl restart

关于gitlab搭建和支持https部分在官方文档有详细描述

https://docs.gitlab.com/ce/administration/auth/ldap.html

通过终端修改gitlab的管理员账户

• How to reset your root password

Log into your server with root privileges. Then start a Ruby on Rails console.

Start the console with this command:

gitlab-rails console production

Wait until the console has loaded.

There are multiple ways to find your user. You can search for email or username.

user = User.where(id: 1).first

or

user = User.find_by(email: '[email protected]')

Now you can change your password:

user.password = 'secret_pass'
user.password_confirmation = 'secret_pass'

It’s important that you change both password and password_confirmation to make it work.

Don’t forget to save the changes.

user.save!

Exit the console and try to login with your new password.

全文思路为gitlab搭建好了以后，通过修改配置文件支持https以及ldap认证，通过phpldapadmin（虽然现在已经没人维护了）的这么一个稍微友好一点的界面，提供了包括登录，注册，分组等功能在内的小型工具（如果发现和测试出更好的欢迎艾特，运维组欢迎一切能够提高OPS能力效率的想法和技术革新），然后通过phpldapadmin建立的账户，ldap可以读取到账户信息，在git上通过ldap认证登录，ok，一个全新的git搭建成功了！

新建账户

https://www.thegeekstuff.com/2015/02/openldap-add-users-groups/

# cat adam.ldif
dn: uid=adam,ou=users,dc=tgs,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: adam
uid: adam
uidNumber: 16859
gidNumber: 100
homeDirectory: /home/adam
loginShell: /bin/bash
gecos: adam
userPassword: {crypt}x
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0

mysql

show processlist