forked from sameersbn/docker-gitlab
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
8 changed files
with
263 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| ## GitLab | ||
| ## | ||
| ## Pages serving host | ||
| server { | ||
| listen 0.0.0.0:80; | ||
| listen [::]:80 ipv6only=on; | ||
| ## Replace this with something like pages.gitlab.com | ||
| server_name ~^.*{{GITLAB_PAGES_DOMAIN}}; | ||
| ## Individual nginx logs for GitLab pages | ||
| access_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_access.log; | ||
| error_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_error.log; | ||
| location / { | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| # The same address as passed to GitLab Pages: `-listen-proxy` | ||
| proxy_pass http://localhost:8090/; | ||
| } | ||
| # Define custom error pages | ||
| error_page 403 /403.html; | ||
| error_page 404 /404.html; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| ## GitLab | ||
| ## | ||
|
|
||
| ## Redirects all HTTP traffic to the HTTPS host | ||
| server { | ||
| ## Either remove "default_server" from the listen line below, | ||
| ## or delete the /etc/nginx/sites-enabled/default file. This will cause gitlab | ||
| ## to be served if you visit any address that your server responds to, eg. | ||
| ## the ip address of the server (http://x.x.x.x/) | ||
| listen 0.0.0.0:80; | ||
| listen [::]:80 ipv6only=on; | ||
|
|
||
| ## Replace this with something like pages.gitlab.com | ||
| server_name ~^.*{{GITLAB_PAGES_DOMAIN}}; | ||
| server_tokens off; ## Don't show the nginx version number, a security best practice | ||
|
|
||
| return 301 https://$host:{{GITLAB_PORT}}$request_uri; | ||
|
|
||
| access_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_access.log; | ||
| error_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_error.log; | ||
| } | ||
|
|
||
| ## Pages serving host | ||
| server { | ||
| listen 0.0.0.0:443 ssl; | ||
| listen [::]:443 ipv6only=on ssl http2; | ||
|
|
||
| ## Replace this with something like pages.gitlab.com | ||
| server_name ~^.*{{GITLAB_PAGES_DOMAIN}}; | ||
| server_tokens off; ## Don't show the nginx version number, a security best practice | ||
|
|
||
| ## Strong SSL Security | ||
| ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/ | ||
| ssl on; | ||
| ssl_certificate {{SSL_CERTIFICATE_PATH}}; | ||
| ssl_certificate_key {{SSL_KEY_PATH}}; | ||
|
|
||
| # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs | ||
| ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; | ||
| ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | ||
| ssl_prefer_server_ciphers on; | ||
| ssl_session_cache shared:SSL:10m; | ||
| ssl_session_timeout 5m; | ||
|
|
||
| ## See app/controllers/application_controller.rb for headers set | ||
|
|
||
| ## [Optional] If your certficate has OCSP, enable OCSP stapling to reduce the overhead and latency of running SSL. | ||
| ## Replace with your ssl_trusted_certificate. For more info see: | ||
| ## - https://medium.com/devops-programming/4445f4862461 | ||
| ## - https://www.ruby-forum.com/topic/4419319 | ||
| ## - https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx | ||
| # ssl_stapling on; | ||
| # ssl_stapling_verify on; | ||
| # ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt; | ||
|
|
||
| ## [Optional] Generate a stronger DHE parameter: | ||
| ## sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096 | ||
| ## | ||
| ssl_dhparam {{SSL_DHPARAM_PATH}}; | ||
|
|
||
| ## Individual nginx logs for this GitLab vhost | ||
| access_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_access.log; | ||
| error_log {{GITLAB_LOG_DIR}}/nginx/gitlab_pages_error.log; | ||
|
|
||
| location / { | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| # The same address as passed to GitLab Pages: `-listen-proxy` | ||
| proxy_pass http://localhost:8090/; | ||
| } | ||
|
|
||
| # Define custom error pages | ||
| error_page 403 /403.html; | ||
| error_page 404 /404.html; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters