CentOS7.6.下使用Gitlab官方Docker镜像安装并配置Https支持
环境:
Author: dusuanyun
Date: 2019-03-16
OS: CentOS7.6
Docker: 18.09.0
gitlab-ce: 11.8.2-ce.0 在2019-03-16最新版,中文化比之前版本好很多!
相关文档:
官方Docker说明:https://hub.docker.com/r/gitlab/gitlab-ce
官网的说明:https://docs.gitlab.com/omnibus/docker/
启用SSL的HTTPS:https://docs.gitlab.com/omnibus/settings/nginx.html#enable-https
1.创建目录以便docker容器进行挂载:
例如:home/data/Gitlab/
2.下载gitlab/gitlab-ce:11.8.2-ce.0版本镜像并运行:
docker run --detach \
--hostname gitlab \
--publish 10443:443 --publish 10080:80 --publish 10022:22 \
--name iGitlab \
--restart always \
--volume /home/data/Gitlab/config:/etc/gitlab \
--volume /home/data/Gitlab/logs:/var/log/gitlab \
--volume /home/data/Gitlab/data:/var/opt/gitlab \
gitlab/gitlab-ce:11.8.2-ce.0
命令运行后,自动创建config logs data目录.
本文档中所有docker命令没有使用sudo前缀,是因为配置了当前用户可以直接运行,如果你没有配置过则需要加sudo.
命令说明:
--name 是指创建的容器的名称;
--hostname 是指容器里面的主机名;
--publish 将宿主机的端口10443/10080/10022分别映射到容器内主机的443/80/22端口
运行成功后:访问http://宿主机的IP:10080/ 即可看到web界面,并提示修改root密码
首次启动较慢,大约3-4分钟!
3.创建自签名的证书: 将下面的内容保存为shell运行,按照提示输入即可!
#!/bin/sh
# create self-signed server certificate:
read -p "Enter your hostname or IP : " DOMAIN
echo "Create server key..."
openssl genrsa -des3 -out $DOMAIN.key 1024
echo "Create server certificate signing request..."
SUBJECT="/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=$DOMAIN"
openssl req -new -subj $SUBJECT -key $DOMAIN.key -out $DOMAIN.csr
echo "Remove password..."
mv $DOMAIN.key $DOMAIN.origin.key
openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key
echo "Sign SSL certificate..."
openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt
echo "TODO:"
echo "Copy $DOMAIN.crt to /home/data/Gitlab/config/ssl/$DOMAIN.crt"
echo "Copy $DOMAIN.key to /home/data/Gitlab/config/ssl/$DOMAIN.key"
echo "Add nginx configuration in /home/data/Gitlab/config/gitlab.rb"
参考地址: https://www.cnblogs.com/xieshuang/p/8488458.html
4.配置gitlab启用https:
A.先在config目录下创建ssl目录存放证书:
cd /home/data/Gitlab/config
mkdir ssl
B.将创建的证书拷贝到ssl目录下:
[[email protected] ssl]# pwd
/home/data/Gitlab/config/ssl
[[email protected] ssl]# ls -al
总用量 16
drwx------. 2 root root 85 3月 15 20:08 .
drwxrwxr-x. 4 root root 250 3月 15 20:52 ..
-rwx------. 1 root root 863 3月 15 20:05 server.crt
-rwx------. 1 root root 655 3月 15 20:05 server.csr
-rwx------. 1 root root 887 3月 15 20:05 server.key
-rwx------. 1 root root 963 3月 15 20:05 server.origin.key
红色部分为必须的,我是把生成的全部文件都拷贝过来了!
C.配置gitlab.rb文件
[[email protected] config]# vim /home/data/Gitlab/config/gitlab.rb
配置的地方如下: 下面的行首数字为行号
11 ##! For more details on configuring external_url see:
12 ##! https://docs.gitlab.com/omnibus/settings/configuration.html#configuring-the-external-url-for-gitlab
13 external_url 'https://192.168.1.141:10443'
980 # nginx['enable'] = true
981 # nginx['client_max_body_size'] = '250m'
982 nginx['redirect_http_to_https'] = true
983 nginx['redirect_http_to_https_port'] = 80
994 nginx['ssl_certificate'] = "/etc/gitlab/ssl/server.crt"
995 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/server.key"
996 # nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"
1021 ##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#setting-the-nginx-listen-port
1022 nginx['listen_port'] = 443
1031 # nginx['proxy_connect_timeout'] = 300
1032 nginx['proxy_set_headers'] = {
1033 "Host" => "$http_host_with_default",
1034 "X-Real-IP" => "$remote_addr",
1035 "X-Forwarded-For" => "$proxy_add_x_forwarded_for",
1036 "X-Forwarded-Proto" => "https",
1037 "X-Forwarded-Ssl" => "on",
1038 "Upgrade" => "$http_upgrade",
1039 "Connection" => "$connection_upgrade"
1040 }
1041 # nginx['proxy_cache_path'] = 'proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2'
1046 # nginx['real_ip_recursive'] = nil
1047 nginx['custom_error_pages'] = {
1048 '404' => {
1049 'title' => 'Example title',
1050 'header' => 'Example header',
1051 'message' => 'Example message'
1052 }
1053 }
配置说明:
192.168.1.141 是宿主机器的IP地址.
13行:IP地址是宿主机器的IP地址不是容器内主机的IP,10443端口也是宿主机端口;
982行:配置http自动跳转到https协议的地址;
983行:80端口是容器内的端口,如果不配配置http://宿主IP:10080/将不可访问;
994-995行:配置创建的自签名证书;
1022行:配置监听容器内的443端口,注意不是外面主机的10443端口,我刚开始搞错了,死活不通!
1032-1040与1047-1053行,应该是可以不配置的,不过我没有测试.
D.让配置生效:
进入容器内部:
docker exec -it iGitlab bash
在容器内执行:
gitlab-ctl hup nginx
gitlab-ctl reconfigure
5.至此:
可以正常访问:https://主机IP:10443/
访问:http://主机IP:10080/会自动跳转到https://主机IP:10443/
6.如何使用gitlab,自己百度即可!