gitlab生成证书支持HTTPS方式

我前面写过一遍类似的文章https://blog.csdn.net/zhuwei_clark/article/details/90445601​​​​​​​

但是这种方式设置之后再使用的过程中会遇到一些问题，所以重新纠正下，安装过程没什么变化。

yum -y install policycoreutils openssh-server openssh-clients postfix
wget https://mirrors.tuna.tsinghua.edu.cn/gitlab-ce/yum/el7/gitlab-ce-11.4.3-ce.0.el7.x86_64.rpm
yum install policycoreutils-python
rpm -i gitlab-ce-11.4.3-ce.0.el7.x86_64.rpm 

 证书生成：

1. 创建 Private Key，这里需要输入密码，记住下密码，在下面需要用到

openssl genrsa -des3 -out /etc/gitlab/ssl/git.zhubanxian.com.key 2048

2. 生成 Certificate Request

openssl req -new -key /etc/gitlab/ssl/git.zhubanxian.com.key -out /etc/gitlab/ssl/git.zhubanxian.com.csr

输入一些信息

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:clark
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:zhubanxian
Organizational Unit Name (eg, section) []:zhubanxian
Common Name (eg, your name or your server's hostname) []:zhubanxian
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456789
An optional company name []:zhubanxian

上面2条命令可以进行合并

openssl req -nodes -newkey rsa:2048 -keyout git.zhubanxian.com.key -out git.zhubanxian.com.csr

3. 移除Private Key 中的密码短语

cp -v /etc/gitlab/ssl/git.zhubanxian.com.{key,original}
openssl rsa -in /etc/gitlab/ssl/git.zhubanxian.com.original -out /etc/gitlab/ssl/git.zhubanxian.com.key
rm -v /etc/gitlab/ssl/git.zhubanxian.com.original

4. 创建证书

openssl x509 -req -days 1460 -in /etc/gitlab/ssl/git.zhubanxian.com.csr -signkey /etc/gitlab/ssl/git.zhubanxian.com.key -out /etc/gitlab/ssl/git.zhubanxian.com.crt

5. 移除证书请求文件

rm -v /etc/gitlab/ssl/git.zhubanxian.com.csr 

6. 设置文件权限

chmod 600 /etc/gitlab/ssl/git.zhubanxian.com.*

gitlab 配置更改

vim /etc/gitlab/gitlab.rb

external_url 'https://git.zhubanxian.com'
nginx['redirect_http_to_https'] = true
nginx['ssl_certificate']= "/etc/gitlab/ssl/git.zhubanxian.com.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/git.zhubanxian.com.key"

重新加载配置文件

gitlab-ctl reconfigure

外部NGINX配置修改

upstream  git{
    server  172.17.4.179:443 weight=1;
}

server {
    listen 443;
    server_name git.zhubanxian.com;
    ssl on;
    ssl_certificate /etc/nginx/vhosts/git/2220513_git.zhubanxian.com.pem;
    ssl_certificate_key /etc/nginx/vhosts/git/2220513_git.zhubanxian.com.key;


    location ~ ^/(.*){
        #注意这里使用https
        proxy_pass https://git;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

}

server {
    listen 80;
    server_name git.zhubanxian.com;

    location ^~ /.well-known/acme-challenge/ {
        alias /data/sites/challenges/;
        try_files $uri = 404;
    }

    location / {
        rewrite ^/(.*)$ https://$host/$1 permanent;
    }
}