Commit e13d5e42 authored by Marin Jankovski's avatar Marin Jankovski
Browse files

Allow to set any proxy header.

parent e217cc40

files/gitlab-config-template/gitlab.rb.template

+7 −4
Original line number Diff line number Diff line
@@ -473,10 +473,13 @@ external_url 'GENERATED_EXTERNAL_URL' 
# nginx['proxy_read_timeout'] = 300

# nginx['proxy_connect_timeout'] = 300

# nginx['set_proxy_headers'] = true

# nginx['proxy_host'] = "$http_host"

# nginx['proxy_x_real_ip'] = "$remote_addr"

# nginx['proxy_x_forwarded_for'] = "$proxy_add_x_forwarded_for"

# nginx['proxy_x_forwarded_proto'] = "http"

# nginx['proxy_set_headers'] = {

#  "Host" => "$http_host",

#  "X-Real-IP" => "$remote_addr",

#  "X-Forwarded-For" => "$proxy_add_x_forwarded_for",

#  "X-Forwarded-Proto" => "https",

#  "X-Forwarded-Ssl" => "on"

# }



## Advanced settings

# nginx['dir'] = "/var/opt/gitlab/nginx"

files/gitlab-cookbooks/gitlab/attributes/default.rb

+8 −0
Original line number Diff line number Diff line
@@ -437,6 +437,14 @@ default['gitlab']['nginx']['proxy_host'] = "$http_host" 
default['gitlab']['nginx']['proxy_x_real_ip'] = "$remote_addr"

default['gitlab']['nginx']['proxy_x_forwarded_for'] = "$proxy_add_x_forwarded_for"

default['gitlab']['nginx']['proxy_x_forwarded_proto'] = nil

default['gitlab']['nginx']['proxy_set_headers'] = {

  "Host" => "$http_host",

  "X-Real-IP" => "$remote_addr",

  "X-Forwarded-For" => "$proxy_add_x_forwarded_for",

  "X-Forwarded-Proto" => "http",

  "X-Forwarded-Ssl" => nil

}





###

# Logging

files/gitlab-cookbooks/gitlab/libraries/gitlab.rb

+18 −2
Original line number Diff line number Diff line
@@ -126,12 +126,12 @@ module Gitlab 
      case uri.scheme

      when "http"

        Gitlab['gitlab_rails']['gitlab_https'] = false

        Gitlab['nginx']['proxy_x_forwarded_proto'] ||= "http"

        parse_nginx_proxy_headers(false)

      when "https"

        Gitlab['gitlab_rails']['gitlab_https'] = true

        Gitlab['nginx']['ssl_certificate'] ||= "/etc/gitlab/ssl/#{uri.host}.crt"

        Gitlab['nginx']['ssl_certificate_key'] ||= "/etc/gitlab/ssl/#{uri.host}.key"

        Gitlab['nginx']['proxy_x_forwarded_proto'] ||= "https"

        parse_nginx_proxy_headers(true)

      else

        raise "Unsupported external URL scheme: #{uri.scheme}"

      end
@@ -313,6 +313,22 @@ module Gitlab 
      end

    end



    def parse_nginx_proxy_headers(https)

      value_from_gitlab_rb = Gitlab['nginx']['proxy_set_headers']

      default_from_attributes = node['gitlab']['nginx']['proxy_set_headers']



      if https

        default_from_attributes = default_from_attributes.to_hash.merge('X-Forwarded-Proto' => "https") unless value_from_gitlab_rb && value_from_gitlab_rb['X-Forwarded-Proto']

        default_from_attributes = default_from_attributes.to_hash.merge('X-Forwarded-Ssl' => "on") unless value_from_gitlab_rb && value_from_gitlab_rb['X-Forwarded-Ssl']

      end



      Gitlab['nginx']['proxy_set_headers'] = if value_from_gitlab_rb

                                               default_from_attributes.merge(value_from_gitlab_rb.to_hash)

                                             else

                                               default_from_attributes

                                             end

    end



    def parse_ci_external_url

      return unless ci_external_url

      # Enable gitlab_ci. This setting will be picked up by parse_gitlab_ci

files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb

+3 −14
Original line number Diff line number Diff line
@@ -106,20 +106,9 @@ server { 
    proxy_http_version 1.1;



    <% if @set_proxy_headers %>

    <% if @proxy_host %>

    proxy_set_header    Host                <%= @proxy_host %>;

    <% end %>

    <% if @proxy_x_real_ip %>

    proxy_set_header    X-Real-IP           <%= @proxy_x_real_ip %>;

    <% end %>

    <% if @https %>

    proxy_set_header    X-Forwarded-Ssl     on;

    <% end %>

    <% if @proxy_x_forwarded_for %>

    proxy_set_header    X-Forwarded-For     <%= @proxy_x_forwarded_for %>;

    <% end %>

    <% if @proxy_x_forwarded_proto %>

    proxy_set_header    X-Forwarded-Proto   <%= @proxy_x_forwarded_proto %>;

    <% @proxy_set_headers.each do |header| %>

    <% next if header[1].nil? %>

    proxy_set_header <%= header[0] %> <%= header[1] %>;

    <% end %>

    <% end %>