# GITLAB
# Contributors: yin8086, sashkab, orkoden, axilleas
# App Version: 5.4 - 6.0

# Modified from nginx http version
# Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/

# You need to run openssl to generate a self-signed ssl certificate.
# cd /etc/nginx/
# sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
# sudo chmod o-r gitlab.key
# Also you need to edit gitlab-shell config.
#  1) Set "gitlab_url" param in gitlab-shell/config.yml to https://git.example.com
#  2) Set "ca_file" to /etc/nginx/gitlab.crt
#  3) Set "self_signed_cert" to true
# You also need to edit gitlab/config/gitlab.yml
#  1) Define port for http "port: 443"
#  2) Enable https "https: true"
#  3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"

upstream gitlab {

  ## Uncomment if you have set up puma/unicorn to listen on a unix socket (recommended).
  server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;

  ## Uncomment if puma/unicorn are configured to listen on a tcp port.
  ## Check the port number in /home/git/gitlab/config/{puma.rb/unicorn.rb}
  # server 127.0.0.1:9292;
}

# This is a normal HTTP host which redirects all traffic to the HTTPS host.
# Replace git.example.com with your FQDN.
server {
    listen *:80;
    server_name git.example.com;
    server_tokens off;
    root /nowhere; # this doesn't have to be a valid path since we are redirecting, you don't have to change it.
    rewrite ^ https://$server_name$request_uri permanent;
}
server {
    listen 443 ssl;
    server_name git.example.com;
    server_tokens off;
    root /home/git/gitlab/public;

    ssl on;
    ssl_certificate /etc/nginx/gitlab.crt;
    ssl_certificate_key /etc/nginx/gitlab.key;
    ssl_protocols  SSLv3 TLSv1 TLSv1.2;
    ssl_ciphers AES:HIGH:!ADH:!MD5;
    ssl_prefer_server_ciphers   on;

    # individual nginx logs for this gitlab vhost
    access_log  /var/log/nginx/gitlab_access.log;
    error_log   /var/log/nginx/gitlab_error.log;

    location / {
        # serve static files from defined root folder;.
        # @gitlab is a named location for the upstream fallback, see below
        try_files $uri $uri/index.html $uri.html @gitlab;
    }

    # if a file, which is not found in the root folder is requested,
    # then the proxy pass the request to the upsteam (gitlab unicorn)
    location @gitlab {
        proxy_read_timeout    300; # https://github.com/gitlabhq/gitlabhq/issues/694
        proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
        proxy_redirect        off;

        proxy_set_header  X-Forwarded-Proto https;
        proxy_set_header  X-Forwarded-Ssl   on;
        proxy_set_header  Host              $http_host;
        proxy_set_header  X-Real-IP         $remote_addr;

        proxy_pass http://gitlab;
    }
}