Gitlab

De Banane Atomic
Aller à la navigationAller à la recherche

Links

Installation

  1. install and configure PostgreSQL
Bash.svg
sudo pacman gitlab
/etc/webapps/gitlab/gitlab.yml
host: gitlab.domain.net
port: 443
https: true

Secret string

Fill the following files with a secret:

Bash.svg
hexdump -v -n 64 -e '1/1 "%02x"' /dev/urandom | sudo dd of=/etc/webapps/gitlab/secret
sudo chmod 640 /etc/webapps/gitlab/secret

hexdump -v -n 64 -e '1/1 "%02x"' /dev/urandom | sudo dd of=/etc/webapps/gitlab-shell/secret
sudo chmod 640 /etc/webapps/gitlab-shell/secret

Set secrets in the following configuration file:

/etc/webapps/gitlab/secrets.yml
production:
  secret_key_base: [secret]
  db_key_base: [secret]
  otp_key_base: [secret]
  openid_connect_signing_key: [secret]

Redis

Bash.svg
# Add user gitlab to group redis
cat /etc/group | grep redis
sudo gpasswd -a gitlab redis

Listen on socket

/etc/redis/redis.conf
unixsocket /run/redis/redis.sock
unixsocketperm 770

# don't listen on TCP
#port 6379
port 0
/etc/webapps/gitlab/resque.yml
development:
  url: unix:/run/redis/redis.sock
test:
  url: unix:/run/redis/redis.sock
production:
  url: unix:/run/redis/redis.sock

PostgreSQL database

Bash.svg
# switch to the PostgreSQL user
sudo -iu postgres

# create a user named gitlab with superuser rights
createuser --interactive

# login into the databases server
psql

# change the password of the gitlab user
\password gitlab

# create the database
create database gitlabdb OWNER gitlab;
/var/lib/postgres/data/pg_hba.conf
# TYPE  DATABASE        USER            METHOD
local   gitlabdb        gitlab          scram-sha-256
Bash.svg
# login as gitlab
psql -U gitlab -d gitlabdb
/etc/webapps/gitlab/database.yml
production:
  main:
    adapter: postgresql
    encoding: unicode
    database: gitlabdb
    username: gitlab
    password: [password]
    # host: localhost
    # port: 5432
    socket: /run/postgresql/.s.PGSQL.5432
Bash.svg
# start redis and gitlab-gitaly
sc-start redis
sc-start gitlab-gitaly

cd /usr/share/webapps/gitlab
sudo -u gitlab $(cat environment | xargs) bundle-2.7 exec rake gitlab:setup

Check

Bash.svg
# Adjust modifier bits
sudo chmod -R ug+rwX,o-rwx /var/lib/gitlab/repositories/
sudo chmod -R ug-s /var/lib/gitlab/repositories
sudo find /var/lib/gitlab/repositories/ -type d -print0 | xargs -0 sudo chmod g+s

sc-start postgresql
sc-start redis
sc-start gitlab.target

sudo -u gitlab $(cat environment | xargs) bundle-2.7 exec rake gitlab:env:info
sudo -u gitlab $(cat environment | xargs) bundle-2.7 exec rake gitlab:check

Nginx

/etc/nginx/sites-available/gitlab.conf
upstream gitlab-workhorse {
  server unix:/run/gitlab/gitlab-workhorse.socket fail_timeout=0;
}

server {
  listen 80;                  # IPv4 HTTP
  #listen 443 ssl http2;      # uncomment to enable IPv4 HTTPS + HTTP/2
  #listen [::]:80;            # uncomment to enable IPv6 HTTP
  #listen [::]:443 ssl http2; # uncomment to enable IPv6 HTTPS + HTTP/2
  server_name gitlab.localhost;

  access_log  /var/log/gitlab/nginx_access.log;
  error_log   /var/log/gitlab/nginx_error.log;

  #ssl_certificate ssl/example.com.crt;
  #ssl_certificate_key ssl/example.com.key;

  location ~ ^/(assets)/ {
    root /usr/share/webapps/gitlab/public;
    gzip_static on; # to serve pre-gzipped version
    expires max;
    add_header Cache-Control public;
  }

  location / {
      # unlimited upload size in nginx (so the setting in GitLab applies)
      client_max_body_size 0;

      # proxy timeout should match the timeout value set in /etc/webapps/gitlab/puma.rb
      proxy_read_timeout 60;
      proxy_connect_timeout 60;
      proxy_redirect off;

      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      #proxy_set_header X-Forwarded-Ssl on;

      proxy_pass http://gitlab-workhorse;
  }

  error_page 404 /404.html;
  error_page 422 /422.html;
  error_page 500 /500.html;
  error_page 502 /502.html;
  error_page 503 /503.html;
  location ~ ^/(404|422|500|502|503)\.html$ {
    root /usr/share/webapps/gitlab/public;
    internal;
  }
}