{"id":917,"date":"2020-10-29T07:39:45","date_gmt":"2020-10-29T07:39:45","guid":{"rendered":"https:\/\/www.hort.net\/techblog\/?p=310"},"modified":"2020-10-29T07:39:45","modified_gmt":"2020-10-29T07:39:45","slug":"setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x","status":"publish","type":"post","link":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/","title":{"rendered":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x"},"content":{"rendered":"

Last weekend I decided to install GitLab for Mallorn Computing. I’d been meaning to do it for ages, but I never really got around to it. Surprisingly, I couldn’t find much about the process online, so I thought I’d document and share it.<\/p>\n

I dutifully downloaded the installation package to a fairly empty server, ran it, and immediately freaked out. My server wasn’t just going to run GitLab; it was going to have Apache on it, other Redis databases, MariaDB, etc. GitLab didn’t seem to play nice with other applications and took over all kinds of ports. The install eventually failed when it realized it couldn’t bind to port 80 since Apache was already installed, and I was left with a mess (hint: the command to clean things up is gitlab-ctl cleanse<\/code>).<\/p>\n

I really didn’t want to set up a new dedicated server, so I hoped there was a Docker container I could install instead. Thankfully, a quick Google search showed there was<\/a>.<\/p>\n

The first thing I did was to install the Docker container:<\/p>\n

docker run --detach --hostname git.mallorn.com --publish 4443:4443 --publish 2211:2211 --name gitlab --restart always gitlab\/gitlab-ee:latest<\/code><\/p>\n

Then I edited the GitLab config file and tried a bunch of settings for a few hours. Ultimately, I figured out which ones worked. Running docker exec -it gitlab vi \/etc\/gitlab\/gitlab.rb<\/code> opened a vi session editing the configuration file for GitLab. I had to change the variables below to the values you see.
\n

   \n   external_url 'https:\/\/git.mallorn.com:4443'\n   nginx['ssl_client_certificate'] = "\/etc\/gitlab\/trusted-certs\/cert.pem"\n   nginx['ssl_certificate'] = "\/etc\/gitlab\/trusted-certs\/fullchain.pem"\n   nginx['ssl_certificate_key'] = "\/etc\/gitlab\/trusted-certs\/privkey.pem"\n   gitlab_rails['trusted_proxies'] = ["172.16.1.10"]\n   nginx['proxy_set_headers'] = {\n     "X-Forwarded-Proto" => "https",\n     "X-Forwarded-Ssl" => "on"\n   }\n<\/code><\/pre><\/p>\n
Note that trusted_proxies<\/code> is my internal network; set it to the IP of the interface on your proxy server that will talk to your GitLab installation.<\/p>\n
Once that was done, I had to edit the ssh configuration file to tell it to listen on port 2211 (I now realize I could have just changed my startup parameters when I started the container, but too late now):  I had to run docker exec -it gitlab vi \/assets\/sshd_config<\/code> and change the port to 2211, then save the file.  The last step was to restart the sshd process with docker exec -it gitlab \/etc\/init.d\/sshd restart<\/code>.<\/p>\n
At this point I needed to import my SSL certificates because I had told GitLab to use certs that didn’t exist yet.  I used letsencrypt<\/a> to generate a certificate, then copied it into my Docker container:<\/p>\n
\n   cd \/etc\/letsencrypt\/live\/git.mallorn.com\n   docker cp -a -L cert.pem gitlab:\/etc\/gitlab\/trusted-certs\n   docker cp -a -L privkey.pem gitlab:\/etc\/gitlab\/trusted-certs\n   docker cp -a -L fullchain.pem gitlab:\/etc\/gitlab\/trusted-certs\n<\/code><\/pre><\/p>\n
Your directory will be different; change into the one for your server.  After this is done, restart your container by running sudo docker restart gitlab<\/code>.<\/p>\n
The last step was to create \/etc\/httpd\/conf.d\/git.mallorn.com.conf<\/code>:<\/p>\n
\n   <VirtualHost *:80 *:443>\n\n      ServerName git.mallorn.com\n      RewriteCond %{HTTPS} !=on\n      RewriteRule ^\/?(.*) https:\/\/%{SERVER_NAME}\/$1 [R,L]\n           \n      SSLEngine on\n      SSLHonorCipherOrder on\n      SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1\n      SSLCipherSuite "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"\n      SSLCompression off\n      SSLSessionTickets off\n      SSLCertificateFile \/etc\/letsencrypt\/live\/git.mallorn.com\/cert.pem\n      SSLCertificateKeyFile \/etc\/letsencrypt\/live\/git.mallorn.com\/privkey.pem\n      SSLCertificateChainFile \/etc\/letsencrypt\/live\/git.mallorn.com\/chain.pem\n\n      <Proxy *>\n         Require all granted\n      <\/Proxy>\n   \n      ProxyPreserveHost on\n           \n      SSLProxyEngine on\n      SSLProxyVerify none\n      SSLProxyCheckPeerCN off\n      SSLProxyCheckPeerName off\n      SSLProxyCheckPeerExpire off\n      ProxyRequests Off\n      ProxyPass \/ https:\/\/git.mallorn.com:4443\/ nocanon\n      ProxyPassReverse \/ https:\/\/git.mallorn.com:4443\/ nocanon\n      AllowEncodedSlashes NoDecode\n\n      Header edit Location ^http:\/\/git.mallorn.com\/ https:\/\/git.mallorn.com\/\n      RequestHeader unset Accept-Encoding\n      RequestHeader set Host "git.mallorn.com"\n      RequestHeader add X-Forwarded-Ssl on\n      RequestHeader set X-Forwarded-Proto "https"\n           \n      LogFormat "%h %l %u %t \\"%r\\" %s %b \\"%{Referer}i\\" \\"%{User-agent}i\\""\n      ErrorLog \/var\/log\/httpd\/git.mallorn.com\/error\n      TransferLog \/var\/log\/httpd\/git.mallorn.com\/access\n   <\/VirtualHost>\n<\/code><\/pre>
\nI ran apachectl graceful<\/code> to reload Apache, and from that point forward git.mallorn.com answered HTTP requests.<\/p>\n
Next I had to make ssh work.  Create an ssh key:<\/p>\n
   ssh-keygen -t rsa -b 4096 -f ~\/.ssh\/gitlab.id_rsa<\/code><\/p>\n
Then set up ~\/.ssh\/config<\/code> to reflect that key:<\/p>\n
\n   host git.mallorn.com\n    HostName git.mallorn.com\n    Port 2211\n    IdentityFile ~\/.ssh\/mallorn-git.id_rsa\n    User [your login in GitLab]\n<\/code><\/pre><\/p>\n
Paste the contents of your ~\/.ssh\/gitlab.id_rsa.pub<\/code> file into your key settings in GitLab and you will now be able to check files in and out via ssh.<\/p>\n
Finally, set up a cron job to copy your SSL certs into the container regularly.  This cron entry (saved as \/etc\/cron.d\/gitlab<\/code>) copies the certificates in and restarts the container if they have changed.<\/p>\n
   5 30 * * * root (cd \/etc\/letsencrypt\/live\/git.mallorn.com ; find . -mmin 2 -exec "docker cp -a -L cert.pem gitlab:\/etc\/gitlab\/trusted-certs; docker cp -a -L privkey.pem gitlab:\/etc\/gitlab\/trusted-certs; docker cp -a -L fullchain.pem gitlab:\/etc\/gitlab\/trusted-certs; docker restart gitlab)\n<\/code><\/pre><\/p>\n
Note that you could make the certs available directly to the container instead by starting it with the -v option, and that may ultimately be the route that I take.  <\/p>\n
Lastly, don’t forget to setup backups<\/a>! <\/p>\n","protected":false},"excerpt":{"rendered":"
Last weekend I decided to install GitLab for Mallorn Computing. I’d been meaning to do it for ages, but I never really got around to it. Surprisingly, I couldn’t find much about the process online, so I thought I’d document and share it. I dutifully downloaded the installation package to a fairly empty server, ran […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[65,73,76],"class_list":["post-917","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-gitlab","tag-proxy","tag-ssl"],"yoast_head":"\nSetting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog\" \/>\n<meta property=\"og:description\" content=\"Last weekend I decided to install GitLab for Mallorn Computing. I’d been meaning to do it for ages, but I never really got around to it. Surprisingly, I couldn’t find much about the process online, so I thought I’d document and share it. I dutifully downloaded the installation package to a fairly empty server, ran […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/\" \/>\n<meta property=\"og:site_name\" content=\"hort.net blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-29T07:39:45+00:00\" \/>\n<meta name=\"author\" content=\"Christopher Lindsey\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Lindsey\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/\"},\"author\":{\"name\":\"Christopher Lindsey\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/#\\\/schema\\\/person\\\/c5048c118466b10e17155d29454e63de\"},\"headline\":\"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x\",\"datePublished\":\"2020-10-29T07:39:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/\"},\"wordCount\":511,\"commentCount\":0,\"keywords\":[\"gitlab\",\"proxy\",\"ssl\"],\"articleSection\":[\"system administration\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/\",\"url\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/\",\"name\":\"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/#website\"},\"datePublished\":\"2020-10-29T07:39:45+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/#\\\/schema\\\/person\\\/c5048c118466b10e17155d29454e63de\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/2020\\\/10\\\/29\\\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/\",\"name\":\"hort.net blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/#\\\/schema\\\/person\\\/c5048c118466b10e17155d29454e63de\",\"name\":\"Christopher Lindsey\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/07\\\/Christopher-Lindsey_avatar_1437067426-96x96.jpg\",\"url\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/07\\\/Christopher-Lindsey_avatar_1437067426-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/07\\\/Christopher-Lindsey_avatar_1437067426-96x96.jpg\",\"caption\":\"Christopher Lindsey\"},\"url\":\"https:\\\/\\\/www.hort.net\\\/blog\\\/author\\\/chris\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/","og_locale":"en_US","og_type":"article","og_title":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog","og_description":"Last weekend I decided to install GitLab for Mallorn Computing. I’d been meaning to do it for ages, but I never really got around to it. Surprisingly, I couldn’t find much about the process online, so I thought I’d document and share it. I dutifully downloaded the installation package to a fairly empty server, ran […]","og_url":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/","og_site_name":"hort.net blog","article_published_time":"2020-10-29T07:39:45+00:00","author":"Christopher Lindsey","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Christopher Lindsey","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/#article","isPartOf":{"@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/"},"author":{"name":"Christopher Lindsey","@id":"https:\/\/www.hort.net\/blog\/#\/schema\/person\/c5048c118466b10e17155d29454e63de"},"headline":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x","datePublished":"2020-10-29T07:39:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/"},"wordCount":511,"commentCount":0,"keywords":["gitlab","proxy","ssl"],"articleSection":["system administration"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/","url":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/","name":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x - hort.net blog","isPartOf":{"@id":"https:\/\/www.hort.net\/blog\/#website"},"datePublished":"2020-10-29T07:39:45+00:00","author":{"@id":"https:\/\/www.hort.net\/blog\/#\/schema\/person\/c5048c118466b10e17155d29454e63de"},"breadcrumb":{"@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.hort.net\/blog\/2020\/10\/29\/setting-up-gitlab-as-a-docker-container-behind-a-secure-reverse-proxy-on-centos-7-x\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hort.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Setting up GitLab as a docker container behind a secure reverse proxy on CentOS 7.x"}]},{"@type":"WebSite","@id":"https:\/\/www.hort.net\/blog\/#website","url":"https:\/\/www.hort.net\/blog\/","name":"hort.net blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hort.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.hort.net\/blog\/#\/schema\/person\/c5048c118466b10e17155d29454e63de","name":"Christopher Lindsey","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hort.net\/blog\/wp-content\/uploads\/2015\/07\/Christopher-Lindsey_avatar_1437067426-96x96.jpg","url":"https:\/\/www.hort.net\/blog\/wp-content\/uploads\/2015\/07\/Christopher-Lindsey_avatar_1437067426-96x96.jpg","contentUrl":"https:\/\/www.hort.net\/blog\/wp-content\/uploads\/2015\/07\/Christopher-Lindsey_avatar_1437067426-96x96.jpg","caption":"Christopher Lindsey"},"url":"https:\/\/www.hort.net\/blog\/author\/chris\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/posts\/917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/comments?post=917"}],"version-history":[{"count":0,"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/posts\/917\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/media?parent=917"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/categories?post=917"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hort.net\/blog\/wp-json\/wp\/v2\/tags?post=917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}