centos7.6.使用 docker 安装 gitlab 支持 https

蔚落 2022-01-14 06:27 287阅读 0赞

### 环境: ###

Date: 2019-06-15

OS: CentOS7.6.1810

Docker: 18.09.6

gitlab-ce: gitlab/gitlab-ce:11.11.3-ce.0

### 相关文档: ###

官方Docker说明:https://hub.docker.com/r/gitlab/gitlab-ce

官网的说明:https://docs.gitlab.com/omnibus/docker/

启用SSL的HTTPS:https://docs.gitlab.com/omnibus/settings/nginx.html\#enable-https

### 1.创建目录以便docker容器进行挂载: ###

例如: /home/gitlab/data

### 2.下载 gitlab/gitlab-ce:11.11.3-ce.0 版本镜像并运行: ###

docker run --detach \
        --hostname gitlab \
        --publish 10443:443 --publish 10080:80 --publish 10022:22 \
        --name myGitlab \
        --restart always \
        --volume /home/gitlab/data/config:/etc/gitlab \
        --volume /home/gitlab/data/logs:/var/log/gitlab \
        --volume /home/gitlab/data/data:/var/opt/gitlab \
        gitlab/gitlab-ce:11.11.3-ce.0

命令运行后,自动创建config logs data目录.

本文档中所有docker命令没有使用sudo前缀,是因为配置了当前用户可以直接运行,如果你没有配置过则需要加sudo.

命令说明:

\--name 是指创建的容器的名称;

\--hostname 是指容器里面的主机名;

\--publish 将宿主机的端口10443/10080/10022分别映射到容器内主机的443/80/22端口

运行成功后:访问http://宿主机的IP:10080/ 即可看到web界面,并提示修改root密码

首次启动较慢,大约3-4分钟!

### 3.创建自签名的证书: ###

将下面的内容保存为shell运行,按照提示输入即可!

#!/bin/sh
    
    # create self-signed server certificate:
    
    read -p "Enter your hostname or IP : " DOMAIN
    
    echo "Create server key..."
    
    openssl genrsa -des3 -out $DOMAIN.key 1024
    
    echo "Create server certificate signing request..."
    
    SUBJECT="/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=$DOMAIN"
    
    openssl req -new -subj $SUBJECT -key $DOMAIN.key -out $DOMAIN.csr
    
    echo "Remove password..."
    
    mv $DOMAIN.key $DOMAIN.origin.key
    
    openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key
    
    echo "Sign SSL certificate..."
    
    openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt
    
    echo "TODO:"
    
    echo "Copy $DOMAIN.crt to /home/data/Gitlab/config/ssl/$DOMAIN.crt"
    
    echo "Copy $DOMAIN.key to /home/data/Gitlab/config/ssl/$DOMAIN.key"
    
    echo "Add nginx configuration in /home/data/Gitlab/config/gitlab.rb"

上面我的实际操作:

我在 /home/allen/Documents/gitlab 目录下创建脚本 gensshkey.sh,并将上面脚本复制到里面,然后通过sh gensshkey.sh执行

要求输入域名 domain: register.allen.com

要求输入密码: 自行输入,至少需要4位

参考地址: https://www.cnblogs.com/xieshuang/p/8488458.html

### 4.配置gitlab启用https: ###

A.先在config目录下创建ssl目录存放证书:

cd /home/data/Gitlab/config

mkdir ssl

B.将创建的证书拷贝到ssl目录下:

[root@registry /home/gitlab/data/config/ssl]$ls -ltr
    total 16
    -rw-r--r--. 1 root root 895 Jun 15 10:42 registry.allen.com.crt
    -rw-r--r--. 1 root root 887 Jun 15 10:42 registry.allen.com.key
    -rw-r--r--. 1 root root 963 Jun 15 10:43 registry.allen.com.origin.key
    -rw-r--r--. 1 root root 672 Jun 15 10:43 registry.allen.com.csr

crt和key文件是必须的,我是把生成的全部文件都拷贝过来了!

C.配置gitlab.rb文件

\[root@registry /home/gitlab/data/config\]$vi gitlab.rb

配置的地方如下: 下面的行首数字为行号

11 ##! For more details on configuring external_url see:
    
    12 ##! https://docs.gitlab.com/omnibus/settings/configuration.html#configuring-the-external-url-for-gitlab
    
    13 external_url 'https://192.168.58.129:10443'
    
    980 # nginx['enable'] = true
    
    981 # nginx['client_max_body_size'] = '250m'
    
    982 nginx['redirect_http_to_https'] = true
    
    983 nginx['redirect_http_to_https_port'] = 80
    
    994 nginx['ssl_certificate'] = "/etc/gitlab/ssl/registry.allen.com.crt"
    
    995 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/registry.allen.com.key"
    
    996 # nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"
    
    1021 ##! Docs: https://docs.gitlab.com/omnibus/settings/nginx.html#setting-the-nginx-listen-port
    
    1022 nginx['listen_port'] = 443
    
    1031 # nginx['proxy_connect_timeout'] = 300
    
    1032 nginx['proxy_set_headers'] = {
    
    1033 "Host" => "$http_host_with_default",
    
    1034 "X-Real-IP" => "$remote_addr",
    
    1035 "X-Forwarded-For" => "$proxy_add_x_forwarded_for",
    
    1036 "X-Forwarded-Proto" => "https",
    
    1037 "X-Forwarded-Ssl" => "on",
    
    1038 "Upgrade" => "$http_upgrade",
    
    1039 "Connection" => "$connection_upgrade"
    
    1040 }
    
    1041 # nginx['proxy_cache_path'] = 'proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2'
    
    1046 # nginx['real_ip_recursive'] = nil
    
    1047 nginx['custom_error_pages'] = {
    
    1048 '404' => {
    
    1049 'title' => 'Example title',
    
    1050 'header' => 'Example header',
    
    1051 'message' => 'Example message'
    
    1052 }
    
    1053 }

配置说明:

192.168.58.129 是宿主机器的IP地址.

13行:IP地址是宿主机器的IP地址不是容器内主机的IP,10443端口也是宿主机端口;

982行:配置http自动跳转到https协议的地址;

983行:80端口是容器内的端口,如果不配配置http://宿主IP:10080/将不可访问;

994-995行:配置创建的自签名证书;

1022行:配置监听容器内的443端口,注意不是外面主机的10443端口,我刚开始搞错了,死活不通!

1032-1040与1047-1053行,应该是可以不配置的,不过我没有测试.

D.让配置生效:

进入容器内部:

docker exec -it myGitlab bash

在容器内执行:

gitlab-ctl hup nginx

gitlab-ctl reconfigure

### 5.至此，可以正常访问:https://主机IP:10443/ ###

访问:http://主机IP:10080/会自动跳转到https://主机IP:10443/

### 6.如何使用gitlab,自己百度即可! ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70]: /images/20220114/21e585a4f7f9498abec39a73b2c7f90a.png