Omnibus CE 10.5 update - ignores nginx['redirect_http_to_https'] and tries to listen on :80 anyway

Summary

Updating to 10.5 (CE) with omnibus install ignores redirect_http_to_https and nginx won't work because of that.

Steps to reproduce

Update to 10.5. Have something else than GitLab's nginx listening on port :80 - GitLab won't be accessed. (I have own nginx running on that port.)

What is the current bug behavior?

GitLab is inaccessible. https://docs.gitlab.com/omnibus/settings/nginx.html#redirect-http-requests-to-https is no longer true ("Nginx will no longer listen for unencrypted HTTP traffic on port 80.").

What is the expected correct behavior?

GitLab is accessible :)

Relevant logs and/or screenshots

root@XXX:~# tail /var/log/gitlab/nginx/current 
2018-02-22_21:42:16.02562 2018/02/22 22:42:15 [emerg] 7645#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:16.52588 2018/02/22 22:42:15 [emerg] 7645#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:17.02613 2018/02/22 22:42:15 [emerg] 7645#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:17.52631 2018/02/22 22:42:15 [emerg] 7645#0: still could not bind()
2018-02-22_21:42:17.54675 2018/02/22 22:42:17 [emerg] 7655#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:18.04710 2018/02/22 22:42:17 [emerg] 7655#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:18.54724 2018/02/22 22:42:17 [emerg] 7655#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:19.04770 2018/02/22 22:42:17 [emerg] 7655#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:19.54793 2018/02/22 22:42:17 [emerg] 7655#0: bind() to 0.0.0.0:80 failed (98: Address already in use)
2018-02-22_21:42:20.04902 2018/02/22 22:42:17 [emerg] 7655#0: still could not bind()

EDIT: added curl output:

[neo@sterling ~]$ curl -I https://XXX:8443 
curl: (35) Unknown SSL protocol error in connection to XXX:8443

Results of GitLab environment info

Expand for output related to GitLab environment info 
System information
System:         Debian 9.1
Current User:   git
Using RVM:      no
Ruby Version:   2.3.6p384
Gem Version:    2.6.13
Bundler Version:1.13.7
Rake Version:   12.3.0
Redis Version:  3.2.11
Git Version:    2.14.3
Sidekiq Version:5.0.5
Go Version:     unknown


GitLab information
Version:        10.5.0
Revision:       34d5766
Directory:      /opt/gitlab/embedded/service/gitlab-rails
DB Adapter:     postgresql
URL:            https://[XXX]:8443
HTTP Clone URL: https://[XXX]:8443/some-group/some-project.git
SSH Clone URL:  git@[XXX]:some-group/some-project.git
Using LDAP:     no
Using Omniauth: no


GitLab Shell
Version:        6.0.3
Repository storage paths:
  • default: /var/opt/gitlab/git-data/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks Git: /opt/gitlab/embedded/bin/git

Results of GitLab application Check

Expand for output related to the GitLab application check 
Checking GitLab Shell ...


GitLab Shell version >= 6.0.3 ? ... OK (6.0.3)
Repo base directory exists?
default... yes
Repo storage directories are symlinks?
default... no
Repo paths owned by git:root, or git:git?
default... yes
Repo paths access is drwxrws---?
default... yes
hooks directories in repos are links: ...
1/1 ... ok
1/2 ... ok
1/4 ... ok
6/5 ... ok
6/6 ... ok
1/7 ... ok
3/8 ... ok
11/9 ... ok
1/10 ... ok
1/11 ... ok
14/12 ... ok
14/13 ... ok
11/14 ... ok
18/15 ... ok
3/16 ... ok
19/17 ... ok
19/18 ... ok
3/19 ... repository is empty
3/20 ... ok
8/21 ... ok
19/22 ... ok
11/23 ... ok
20/24 ... ok
22/26 ... ok
11/27 ... ok
3/28 ... ok
14/29 ... ok
1/31 ... ok
11/32 ... ok
19/33 ... ok
35/34 ... ok
37/35 ... ok
3/36 ... ok
19/37 ... ok
19/38 ... ok
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Redis available via internal API: OK


Access to /var/opt/gitlab/.ssh/authorized_keys: OK
gitlab-shell self-check successful


Checking GitLab Shell ... Finished


Checking Sidekiq ...


Running? ... yes
Number of Sidekiq processes ... 1


Checking Sidekiq ... Finished


Reply by email is disabled in config/gitlab.yml
Checking LDAP ...


LDAP is disabled in config/gitlab.yml


Checking LDAP ... Finished


Checking GitLab ...


Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ...
1/1 ... yes
1/2 ... yes
1/4 ... yes
6/5 ... yes
6/6 ... yes
1/7 ... yes
3/8 ... yes
11/9 ... yes
1/10 ... yes
1/11 ... yes
14/12 ... yes
14/13 ... yes
11/14 ... yes
18/15 ... yes
3/16 ... yes
19/17 ... yes
19/18 ... yes
3/19 ... yes
3/20 ... yes
8/21 ... yes
19/22 ... yes
11/23 ... yes
20/24 ... yes
22/26 ... yes
11/27 ... yes
3/28 ... yes
14/29 ... yes
1/31 ... yes
11/32 ... yes
19/33 ... yes
35/34 ... yes
37/35 ... yes
3/36 ... yes
19/37 ... yes
19/38 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.3.5 ? ... yes (2.3.6)
Git version >= 2.9.5 ? ... yes (2.14.3)
Git user has default SSH configuration? ... yes
Active users: ... 30


Checking GitLab ... Finished

Possible fixes

In /var/opt/gitlab/nginx/conf/gitlab-http.conf removing:

server {
  listen *:80;

  server_name XXX;
  server_tokens off; ## Don't show the nginx version number, a security best practice


  location / {
    return 301 https://XXX:8443$request_uri;
  }

  access_log  /var/log/gitlab/nginx/gitlab_access.log gitlab_access;
  error_log   /var/log/gitlab/nginx/gitlab_error.log;
}

fixes the issue. If there's other way to not have this part of config used except

root@XXX:~# grep 'redirect_http_to_https' /etc/gitlab/gitlab.rb 
nginx['redirect_http_to_https'] = false

this would be solved by updating https://docs.gitlab.com/omnibus/settings/nginx.html#redirect-http-requests-to-https

Edited by Luděk Uiberlay