Gerrit之设置https-yellowcong

àì夳堔傛蜴生んèń 2022-05-27 12:07 453阅读 0赞

> 这个gerrit配置https的前提是，nginx已经配置好了证书服务，然后代理到gerrit上。必须将nginx 上面的强制加上了https，这样就不给爸爸报错了，爽歪歪了。

## 1、nginx配置 ##

在nginx 配置的代理地址一定是http访问的，这一点得注意了，不然访问不到服务。

![这里写图片描述][SouthEast]

upstream  proxy_pool_gerrit {
            server 192.168.156.44:8081 weight=10;
        keepalive 512;
    }
    
    server
        { 
                #取消监听
                #listen 80;
                listen 443 ssl;
                        ssl_certificate      server.pem;
                        ssl_certificate_key  server.key;
    
                        ssl_session_cache    shared:SSL:1m;
                        ssl_session_timeout  5m;
    
                        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                        ssl_ciphers  HIGH:!aNULL:!MD5;
                        ssl_prefer_server_ciphers  on;
    
                    server_name gerrit.yellowcong.net;
            index index.html index.htm index.php default.html default.htm default.php;
            root  /data/jeeroot/gerrit.yellowcong.net/ROOT;
    
            #error_page 404 /404.html;
            location / {
                            proxy_next_upstream error timeout http_500 http_502 http_503 http_504 http_404;
                            proxy_read_timeout 10s;
    
                            #auth_basic "Password please";
                #auth_basic_user_file /data/gerrit/htpasswd.conf;
                proxy_http_version 1.1;
                            proxy_set_header Connection "";
                            proxy_connect_timeout 10;
    
                proxy_set_header Host $host;
                        #proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://proxy_pool_gerrit;
                }
            location ~ ^/(WEB-INF)/ {
                    deny all;
                }
    
            location /nginx_status {
                stub_status on;
                access_log   off;
            }
    
            location = /favicon.ico {
                log_not_found off;
                access_log off;
            }
            location = /robots.txt {
                log_not_found off;
                access_log off;
            }
    
            location ~/\. {
                deny all;
                access_log off;
                log_not_found off;
            }
    
                location ~ /\.(ht|svn|git) {
                        deny all;
                }
    
            access_log  /home/wwwlogs/gerrit.yellowcong.net.log  access;
        }
    
    #设置反回为https
    server {
            listen 80;
            server_name gerrit.yellowcong.net;
            index index.html index.htm index.php default.html default.htm default.php;
            root  /data/gerrit/;
            return 301 https://$server_name$request_uri;
    }

## 2、gerrit配置https ##

需要修改canonicalWebUrl 和listenUrl ,这个 listenUrl 表示的是访问的端口地址，也就是nginx代理服务配置的底黑字。canonicalWebUrl 表示显示的地址信息，配置后重启gerrit，就好用了。

[gerrit]
            basePath = git
            canonicalWebUrl = https://gerrit.yellowcong.net/
    [httpd]
            listenUrl = proxy-https://192.168.156.44:8081/

![这里写图片描述][70]

[SouthEast]: /images/20220527/8770cc8c42a644c09b25c293dd160a70.png
[70]: /images/20220527/d39642fe60294c22af7f37f84b2c0fd7.png