gitlab-ssl-apache24.conf 3.82 KB
Newer Older
1 2 3
# This configuration has been tested on GitLab 8.1
# Note this config assumes unicorn is listening on default port 8080 and gitlab-git-http-server is listening on port 8181.
# To allow gitlab-git-http-server to listen on port 8181, edit or create /etc/default/gitlab and change or add the following:
4
# gitlab_git_http_server_options="-listenUmask 0 -listenNetwork tcp -listenAddr 127.0.0.1:8181 -authBackend http://127.0.0.1:8080"
5

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
#Module dependencies
# mod_rewrite
# mod_ssl
# mod_proxy
# mod_proxy_http
# mod_headers

# This section is only needed if you want to redirect http traffic to https.
# You can live without it but clients will have to type in https:// to reach gitlab.
<VirtualHost *:80>
  ServerName gitlab.example.com
  ServerSignature Off

  RewriteEngine on
  RewriteCond %{HTTPS} !=on
  RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L]
</VirtualHost>

<VirtualHost *:443>
  SSLEngine on
  #strong encryption ciphers only
  #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
  SSLProtocol all -SSLv2
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateFile /etc/httpd/ssl.crt/gitlab.example.com.crt
  SSLCertificateKeyFile /etc/httpd/ssl.key/gitlab.example.com.key
  SSLCACertificateFile /etc/httpd/ssl.crt/your-ca.crt

  ServerName gitlab.example.com
  ServerSignature Off

  ProxyPreserveHost On

  # Ensure that encoded slashes are not decoded but left in their encoded state.
  # http://doc.gitlab.com/ce/api/projects.html#get-single-project
  AllowEncodedSlashes NoDecode

  <Location />
    # New authorization commands for apache 2.4 and up
    # http://httpd.apache.org/docs/2.4/upgrading.html#access
    Require all granted

51 52 53
    #Allow forwarding to gitlab-git-http-server
    ProxyPassReverse http://127.0.0.1:8181
    #Allow forwarding to GitLab Rails app (Unicorn)
54 55 56 57
    ProxyPassReverse http://127.0.0.1:8080
    ProxyPassReverse http://gitlab.example.com/
  </Location>

58
  # Apache equivalent of nginx try files
59 60 61
  # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
  # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
  RewriteEngine on
62

63
  #Forward these requests to gitlab-git-http-server
64 65
  RewriteCond %{REQUEST_URI} ^/[\w\.-]+/[\w\.-]+/repository/archive.* [OR]
  RewriteCond %{REQUEST_URI} ^/api/v3/projects/.*/repository/archive.* [OR]
66
  RewriteCond %{REQUEST_URI} ^/[\w\.-]+/[\w\.-]+/(info/refs|git-upload-pack|git-receive-pack)$
67 68
  RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]

69
  #Forward any other requests to GitLab Rails app (Unicorn)
70 71
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
  RewriteCond %{REQUEST_URI} ^/uploads
72
  RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA,NE]
73 74 75 76 77 78 79 80 81 82 83 84
  RequestHeader set X_FORWARDED_PROTO 'https'
  RequestHeader set X-Forwarded-Ssl on

  # needed for downloading attachments
  DocumentRoot /home/git/gitlab/public

  #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
  ErrorDocument 404 /404.html
  ErrorDocument 422 /422.html
  ErrorDocument 500 /500.html
  ErrorDocument 503 /deploy.html

85 86 87
  # It is assumed that the log directory is in /var/log/httpd.
  # For Debian distributions you might want to change this to
  # /var/log/apache2.
88 89 90 91 92 93 94
  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/httpd/logs/gitlab.example.com_error.log
  CustomLog /var/log/httpd/logs/gitlab.example.com_forwarded.log common_forwarded
  CustomLog /var/log/httpd/logs/gitlab.example.com_access.log combined env=!dontlog
  CustomLog /var/log/httpd/logs/gitlab.example.com.log combined

</VirtualHost>