En fait c’est très simple il suffit de faire un sous-domaine classique et de lancer certbot pour le sous-domaine concerné.
Non la difficulté réside dans la configuration du sous-domaine.
Je me mets la configuration ici pour l’avenir au cas où je me décide à faire encore des miracles en supprimant par mégarde la sauvegarde de mes confs (oups ^^)
Concernant le gitlab.rb : Je mets les numéros de ligne à titre informatif j’ai même modifier d’autres trucs mais qui ne concernent pas notre sujet
|
1 2 3 4 |
external_url 'https://sous-domaine.ndd.tld' # vers la ligne 13 gitlab_workhorse['listen_network'] = "tcp" # vers la ligne 520 gitlab_workhorse['listen_addr'] = "127.0.0.1:8181" # vers la ligne 521 nginx['enable'] = false # vers la ligne 820 |
La conf Apache :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
# Note this config assumes unicorn is listening on default port 8080 and # gitlab-workhorse is listening on port 8181. To allow gitlab-workhorse to # listen on port 8181, edit or create /etc/default/gitlab and change or add the following: # # gitlab_workhorse_options="-listenUmask 0 -listenNetwork tcp -listenAddr 127.0.0.1:8181 -authBackend http://127.0.0.1:8080" # #Module dependencies # mod_rewrite # mod_ssl # mod_proxy # mod_proxy_http # mod_headers <VirtualHost *:80> ServerName sous-domaine.ndd.tld ServerSignature Off ProxyPreserveHost On # Ensure that encoded slashes are not decoded but left in their encoded state. # http://doc.gitlab.com/ce/api/projects.html#get-single-project AllowEncodedSlashes NoDecode <Location /> # New authorization commands for apache 2.4 and up # http://httpd.apache.org/docs/2.4/upgrading.html#access Require all granted #Allow forwarding to gitlab-workhorse ProxyPassReverse http://127.0.0.1:8181 ProxyPassReverse http://sous-domaine.ndd.tld/ </Location> # Apache equivalent of nginx try files # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab RewriteEngine on #Forward all requests to gitlab-workhorse except existing files like error documents RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR] RewriteCond %{REQUEST_URI} ^/uploads/.* RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE] RequestHeader set X_FORWARDED_PROTO 'https' RequestHeader set X-Forwarded-Ssl on # needed for downloading attachments DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up. ErrorDocument 404 /404.html ErrorDocument 422 /422.html ErrorDocument 500 /500.html ErrorDocument 502 /502.html ErrorDocument 503 /503.html # It is assumed that the log directory is in /var/log/httpd. # For Debian distributions you might want to change this to # /var/log/apache2. LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded ErrorLog /var/log/apache2/sous-domaine.ndd.tld_error.log CustomLog /var/log/apache2/sous-domaine.ndd.tld_forwarded.log common_forwarded CustomLog /var/log/apache2/sous-domaine.ndd.tld_access.log combined env=!dontlog CustomLog /var/log/apache2/sous-domaine.ndd.tld.log combined </VirtualHost> |