Gitlab CE Apache2.4 SSL重定向到不同的站点,而不是Gitlab的主力
我最近尝试将我的gitlab ce(版本8.13.6)实例移动到我的Apache web服务器(版本2.4.18)。但是,当尝试使用Lets加密证书来设置SSL时,它在HTTP上运行良好。它将我重定向到另一个Apache站点(默认站点),而不是gitlab工作区。知道它为什么这么做吗?如何将其重定向到gitlab?请在下面找到我的站点配置:Gitlab CE Apache2.4 SSL重定向到不同的站点,而不是Gitlab的主力,apache,ssl,gitlab,gitlab-omnibus,Apache,Ssl,Gitlab,Gitlab Omnibus,我最近尝试将我的gitlab ce(版本8.13.6)实例移动到我的Apache web服务器(版本2.4.18)。但是,当尝试使用Lets加密证书来设置SSL时,它在HTTP上运行良好。它将我重定向到另一个Apache站点(默认站点),而不是gitlab工作区。知道它为什么这么做吗?如何将其重定向到gitlab?请在下面找到我的站点配置: # This configuration has been tested on GitLab 8.2 # Note this config assumes
# This configuration has been tested on GitLab 8.2
# Note this config assumes unicorn is listening on default port 8080 and
# gitlab-workhorse is listening on port 8181. To allow gitlab-workhorse to
# listen on port 8181, edit /etc/gitlab/gitlab.rb and change the following:
#
# gitlab_workhorse['listen_network'] = "tcp"
# gitlab_workhorse['listen_addr'] = "127.0.0.1:8181"
#
#Module dependencies
# mod_rewrite
# mod_ssl
# mod_proxy
# mod_proxy_http
# mod_headers
# This section is only needed if you want to redirect http traffic to https.
# You can live without it but clients will have to type in https:// to reach gitlab.
<VirtualHost *:80>
ServerName gitlab.bancey.net
ServerSignature Off
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L]
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
#strong encryption ciphers only
#see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
SSLProtocol all -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"
Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
SSLCompression Off
SSLCertificateFile /path/to/cert
SSLCertificateKeyFile /path/to/key
SSLCertificateChainFile /path/to/chain
ServerName gitlab.bancey.net
ServerSignature Off
ProxyPreserveHost On
# Ensure that encoded slashes are not decoded but left in their encoded state.
# http://doc.gitlab.com/ce/api/projects.html#get-single-project
AllowEncodedSlashes NoDecode
<Location />
# New authorization commands for apache 2.4 and up
# http://httpd.apache.org/docs/2.4/upgrading.html#access
Require all granted
#Allow forwarding to gitlab-workhorse
ProxyPassReverse http://127.0.0.1:8181
ProxyPassReverse http://gitlab.bancey.net/
</Location>
# Apache equivalent of nginx try files
# http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
# http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
RewriteEngine on
#Don't escape encoded characters in api requests
RewriteCond %{REQUEST_URI} ^/api/v3/.*
RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
#Forward all requests to gitlab-workhorse except existing files like error documents
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_URI} ^/uploads/.*
RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
RequestHeader set X_FORWARDED_PROTO 'https'
RequestHeader set X-Forwarded-Ssl on
# needed for downloading attachments
DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public
#Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
ErrorDocument 404 /404.html
ErrorDocument 422 /422.html
ErrorDocument 500 /500.html
ErrorDocument 502 /502.html
ErrorDocument 503 /503.html
# It is assumed that the log directory is in /var/log/httpd.
# For Debian distributions you might want to change this to
# /var/log/apache2.
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
ErrorLog /etc/apache2/logs/gitlab.bancey.net.error.log
CustomLog /etc/apache2/logs/gitlab.bancey.net.forwarded.log common_forwarded
CustomLog /etc/apache2/logs/gitlab.bancey.net.access.log combined env=!dontlog
CustomLog /etc/apache2/logs/gitlab.bancey.net.log combined
</VirtualHost>
#此配置已在GitLab 8.2上进行了测试
#注意:此配置假定unicorn正在侦听默认端口8080和8080
#gitlab workhorse正在侦听端口8181。允许gitlab workhorse
#在端口8181上侦听,编辑/etc/gitlab/gitlab.rb并更改以下内容:
#
#gitlab_workhorse['listen_network']=“tcp”
#gitlab_workhorse['listen_addr']=“127.0.0.1:8181”
#
#模块依赖关系
#修改
#mod_ssl
#mod_代理
#mod_proxy_http
#模头
#仅当您希望将http通信重定向到https时,才需要此部分。
#您可以不使用它,但客户端必须键入https://才能访问gitlab。
ServerName gitlab.bancey.net
服务器签名关闭
重新启动发动机
重写cond%{HTTPS}=在…上
重写规则。*https://%{SERVER_NAME}%{REQUEST_URI}[NE,R,L]
斯伦金安
#仅强加密密码
#参见密码(1)http://www.openssl.org/docs/apps/ciphers.html
SSLProtocol all-SSLv2
SSLHonorCipherOrder开启
SSLCipherSuite“ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS”
标头添加严格的传输安全性:“最大年龄=15768000;包括子域”
SSL压缩关闭
SSLCertificateFile/path/to/cert
SSLCertificateKeyFile/path/to/key
SSLCertificateChainFile/path/to/chain
ServerName gitlab.bancey.net
服务器签名关闭
代理主机
#确保编码的斜杠未被解码,而是处于编码状态。
# http://doc.gitlab.com/ce/api/projects.html#get-单个项目
AllowEncodeDSL节点代码
#针对apache 2.4及更高版本的新授权命令
# http://httpd.apache.org/docs/2.4/upgrading.html#access
要求所有授权
#允许转发到gitlab workhorse
ProxyPassReversehttp://127.0.0.1:8181
ProxyPassReversehttp://gitlab.bancey.net/
#相当于Apache的nginx try文件
# http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
# http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
重新启动发动机
#不转义api请求中的编码字符
重写cond%{REQUEST_URI}^/api/v3/*
重写规则。*http://127.0.0.1:8181%{REQUEST_URI}[P,QSA,NE]
#将所有请求转发到gitlab workhorse,但现有文件(如错误文档)除外
重写cond%{DOCUMENT\u ROOT}/%{REQUEST\u FILENAME}-f[或]
RewriteCond%{REQUEST_URI}^/uploads/*
重写规则。*http://127.0.0.1:8181%{REQUEST_URI}[P,QSA]
RequestHeader集合X_转发_协议“https”
RequestHeader在上设置X-Forwarded-Ssl
#需要下载附件
DocumentRoot/opt/gitlab/embedded/service/gitlab-rails/public
#设置apache错误文档,如果后端出现故障(即503错误),则会弹出维护/部署页面。
错误文档404/404.html
错误文档422/422.html
ErrorDocument 500/500.html
错误文档502/502.html
错误文档503/503.html
#假设日志目录位于/var/log/httpd中。
#对于Debian发行版,您可能希望将其更改为
#/var/log/apache2。
日志格式“%{X-Forwarded-For}i%l%u%t\%r\”%>s%b”公共\u转发
ErrorLog/etc/apache2/logs/gitlab.bancey.net.error.log
CustomLog/etc/apache2/logs/gitlab.bancey.net.forwarded.log common_forwarded
CustomLog/etc/apache2/logs/gitlab.bancey.net.access.log组合环境=!唐特洛
CustomLog/etc/apache2/logs/gitlab.bancey.net.log组合
感谢您的帮助:)在IE11、Edge、Chrome中为我重定向到其https URL()。您使用什么浏览器或工具进行连接?正如SSL实验室()所指出的,该站点将在支持SNI的客户端中工作。@AnandBhat谢谢,问题是它显示的页面不是它应该是的Apache站点,它应该显示gitlab登录名。就像我使用http而不是https一样。它似乎忽略了应该将我的请求发送到gitlab workhorse的重写规则。您是否看到了其他内容:@AnandBhat I was,禁用并重新启用Apache站点配置似乎已经修复了它。感谢您的帮助:)在IE11、Edge、Chrome中为我重定向到它的https URL()。您使用什么浏览器或工具进行连接?正如SSL实验室()所指出的,该站点将在支持SNI的客户端中工作。@AnandBhat谢谢,问题是它显示的页面不是它应该是的Apache站点,它应该显示gitlab登录名。就像我使用http而不是https一样。它似乎忽略了应该将我的请求发送到gitlab workhorse的重写规则。您是否看到了其他内容:@AnandBhat I was,禁用并重新启用Apache站点配置似乎已经修复了它。谢谢你的帮助:)