diff --git a/web-server/nginx/gitlab-ssl b/web-server/nginx/gitlab-ssl index b2b1cd1..c6a56e9 100644 --- a/web-server/nginx/gitlab-ssl +++ b/web-server/nginx/gitlab-ssl @@ -1,36 +1,44 @@ # GITLAB -# Maintainer: @yin8086 -# App Version: 4.1 +# Contributors: yin8086, sashkab, orkoden, axilleas +# App Version: 5.4 - 6.0 # Modified from nginx http version # Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/ -# You need from run openssl to generate the ssl certificate. -# $ sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key -# $ sudo chmod o-r gitlab.key +# You need to run openssl to generate a self-signed ssl certificate. +# cd /etc/nginx/ +# sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key +# sudo chmod o-r gitlab.key upstream gitlab { - server unix:/home/gitlab/gitlab/tmp/sockets/gitlab.socket; + + ## Uncomment if you have set up puma/unicorn to listen on a unix socket (recommended). + server unix:/home/git/gitlab/tmp/sockets/gitlab.socket; + + ## Uncomment if puma/unicorn are configured to listen on a tcp port. + ## Check the port number in /home/git/gitlab/config/{puma.rb/unicorn.rb} + # server 127.0.0.1:9292; } # This is a normal HTTP host which redirects all traffic to the HTTPS host. +# Replace git.example.com with your FQDN. server { - listen 80; - server_name Domain_NAME; + listen *:80; + server_name git.example.com; server_tokens off; - root /nowhere; - rewrite ^ https://gitlab.stardrad.com$request_uri permanent; + root /nowhere; # this doesn't have to be a valid path since we are redirecting, you don't have to change it. + rewrite ^ https://$server_name$request_uri permanent; } server { listen 443; - server_name Domain_NAME; + server_name git.example.com; server_tokens off; - root /home/gitlab/gitlab/public; + root /home/git/gitlab/public; ssl on; - ssl_certificate gitlab.crt; - ssl_certificate_key gitlab.key; - ssl_protocols SSLv3 TLSv1 TLSv2; + ssl_certificate /etc/nginx/gitlab.crt; + ssl_certificate_key /etc/nginx/gitlab.key; + ssl_protocols SSLv3 TLSv1 TLSv1.2; ssl_ciphers AES:HIGH:!ADH:!MD5; ssl_prefer_server_ciphers on; @@ -47,15 +55,15 @@ server { # if a file, which is not found in the root folder is requested, # then the proxy pass the request to the upsteam (gitlab unicorn) location @gitlab { - proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694 + proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694 proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694 - proxy_redirect off; + proxy_redirect off; - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; proxy_pass http://gitlab; } -} \ No newline at end of file +}