jlengrand/gitlab-recipes
1
0
Fork 0
mirror of https://github.com/jlengrand/gitlab-recipes.git synced 2026-03-10 08:11:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refine nginx config for ssl connections. Implements #67 and #92

Browse Source
This commit is contained in:
Axilleas Pipinellis
2013-08-05 16:08:32 +03:00
parent fabeb6ab74
commit 2afea0df60
1 changed files with 30 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
web-server/nginx/gitlab-ssl
View File

@@ -1,36 +1,44 @@
# GITLAB
# Maintainer: @yin8086
# App Version: 4.1
# Contributors: yin8086, sashkab, orkoden, axilleas
# App Version: 5.4 - 6.0
# Modified from nginx http version
# Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
# You need from run openssl to generate the ssl certificate.
# $ sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
# $ sudo chmod o-r gitlab.key
# You need to run openssl to generate a self-signed ssl certificate.
# cd /etc/nginx/
# sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
# sudo chmod o-r gitlab.key
upstream gitlab {
server unix:/home/gitlab/gitlab/tmp/sockets/gitlab.socket;
## Uncomment if you have set up puma/unicorn to listen on a unix socket (recommended).
server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
## Uncomment if puma/unicorn are configured to listen on a tcp port.
## Check the port number in /home/git/gitlab/config/{puma.rb/unicorn.rb}
# server 127.0.0.1:9292;
}
# This is a normal HTTP host which redirects all traffic to the HTTPS host.
# Replace git.example.com with your FQDN.
server {
listen 80;
server_name Domain_NAME;
listen *:80;
server_name git.example.com;
server_tokens off;
root /nowhere;
rewrite ^ https://gitlab.stardrad.com$request_uri permanent;
root /nowhere; # this doesn't have to be a valid path since we are redirecting, you don't have to change it.
rewrite ^ https://$server_name$request_uri permanent;
}
server {
listen 443;
server_name Domain_NAME;
server_name git.example.com;
server_tokens off;
root /home/gitlab/gitlab/public;
root /home/git/gitlab/public;
ssl on;
ssl_certificate gitlab.crt;
ssl_certificate_key gitlab.key;
ssl_protocols SSLv3 TLSv1 TLSv2;
ssl_certificate /etc/nginx/gitlab.crt;
ssl_certificate_key /etc/nginx/gitlab.key;
ssl_protocols SSLv3 TLSv1 TLSv1.2;
ssl_ciphers AES:HIGH:!ADH:!MD5;
ssl_prefer_server_ciphers on;
@@ -47,15 +55,15 @@ server {
# if a file, which is not found in the root folder is requested,
# then the proxy pass the request to the upsteam (gitlab unicorn)
location @gitlab {
proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
proxy_redirect off;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://gitlab;
}
}
}