一、安装 Gitlab
# gitlab.example.com 为 你的域名或者主机IP
docker run --name gitlab \
--hostname gitlab.example.com \
--publish 22:22 \
--restart always \
--volume /home/gitlab/config:/etc/gitlab \
--volume /home/gitlab/logs:/var/log/gitlab \
--volume /home/gitlab/data:/var/opt/gitlab \
-d gitlab/gitlab-ce:latest
注：文章所用 latest == 11.4.4-ce.0
这里我只暴露了官方默认的SSH 22 端口（悄悄的把服务器的SSH端口改成其他，为了给 gitlab 让步），而且本应该还暴露 80、443端口的（--publish 443:443 --publish 80:80 ），gitlab 内置了 nginx 的服务，会占用 80 和 443 端口，但我的服务器上已经装有 nginx 了，所以准备禁用 gitlab 内置 nginx ，改用服务器原有的 nginx，在这里就只暴露 22 端口就行了 大家可以根据实际情况，自行选择暴露的端口。
二、Gitlab 启用 HTTPS
如果不需要启用 HTTPS，关于安装 GitLab 的内容到这里就结束了，如果需要启用 HTTPS，那么到这一步骤我就默认大家已经申请好了 SSL 证书，获取到了以下相关的证书文件，申请 SSL 证书可参考[HTTPS]
# 相关的证书文件
.
└── www.xxx.com
├── cert.pem # Apache服务器端证书
├── chain.pem # Apache根证书和中继证书
├── fullchain.pem # Nginx所需要ssl_certificate文件
├── privkey.pem # 安全证书KEY文件
└── README
2.1、首先确保你的服务器已经有运行 nginx，并且该nginx监听宿主机的 80 和 443 端口
2.2、编辑 /etc/gitlab/gitlab.rb
# 禁用`gitlab`内置的`nginx`
nginx['enable'] = false
# 修改成与`nginx`运行时的用户一致
web_server['external_users'] = ['root']
2.3、修改监听方式和监听地址(如果 nginx 与 gitlab 都在宿主机上，不用改也行；如果 nginx 在 docker 中，则需要修改)
# 监听方式为 tcp
gitlab_workhorse['listen_network'] = "tcp"
# 下面的 111.1.1.1 为本机IP，根据实际情况修改，不能为 localhost 或者 127.0.0.1，否则 docker 访问不到，8181是默认监听的端口
gitlab_workhorse['listen_addr'] = "111.1.1.1:8181"
2.4、最后执行下面命令让配置生效
docker exec gitlab gitlab-ctl reconfigure
配置本机上的 Nginx
新建一个 nginx 的 gitlab.conf 配置文件；下载官方的配置文件，配置文件有 http 和 https两个版本，这里选择 https，并将内容拷贝到 gitlab.conf 中。
https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/nginx
## GitLab
##
## Modified from nginx http version
## Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
## Modified from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
##
## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters that can be uncommented.
##
##################################
## CONTRIBUTING ##
##################################
##
## If you change this file in a Merge Request, please also create
## a Merge Request on https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests
##
###################################
## configuration ##
###################################
##
## See installation.md#using-https for additional HTTPS configuration details.
upstream gitlab-workhorse {
server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
}
## Redirects all HTTP traffic to the HTTPS host
server {
## Either remove "default_server" from the listen line below,
## or delete the /etc/nginx/sites-enabled/default file. This will cause gitlab
## to be served if you visit any address that your server responds to, eg.
## the ip address of the server (http://x.x.x.x/)
listen 0.0.0.0:80;
listen [::]:80 ipv6only=on default_server;
server_name YOUR_SERVER_FQDN; ## Replace this with something like gitlab.example.com
server_tokens off; ## Don't show the nginx version number, a security best practice
return 301 https://$http_host$request_uri;
access_log /var/log/nginx/gitlab_access.log;
error_log /var/log/nginx/gitlab_error.log;
}
## HTTPS host
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ipv6only=on ssl default_server;
server_name YOUR_SERVER_FQDN; ## Replace this with something like gitlab.example.com
server_tokens off; ## Don't show the nginx version number, a security best practice
root /opt/gitlab/embedded/service/gitlab-rails/public;
## Strong SSL Security
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
ssl on;
ssl_certificate /etc/nginx/ssl/gitlab.crt;
ssl_certificate_key /etc/nginx/ssl/gitlab.key;
# GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
## See app/controllers/application_controller.rb for headers set
## [Optional] Enable HTTP Strict Transport Security
## HSTS is a feature improving protection against MITM attacks
## For more information see: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
## [Optional] If your certficate has OCSP, enable OCSP stapling to reduce the overhead and latency of running SSL.
## Replace with your ssl_trusted_certificate. For more info see:
## - https://medium.com/devops-programming/4445f4862461
## - https://www.ruby-forum.com/topic/4419319
## - https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx
# ssl_stapling on;
# ssl_stapling_verify on;
# ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
# resolver 208.67.222.222 208.67.222.220 valid=300s; # Can change to your DNS resolver if desired
# resolver_timeout 5s;
## [Optional] Generate a stronger DHE parameter:
## sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
##
# ssl_dhparam /etc/ssl/certs/dhparam.pem;
## Individual nginx logs for this GitLab vhost
access_log /var/log/nginx/gitlab_access.log;
error_log /var/log/nginx/gitlab_error.log;
location / {
client_max_body_size 0;
gzip off;
## https://github.com/gitlabhq/gitlabhq/issues/694
## Some requests take more than 30 seconds.
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://gitlab-workhorse;
}
}
接着需要修改 gitlab.conf 文件
# 找到
upstream gitlab-workhorse {
server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
}
# 修改为
upstream gitlab-workhorse {
server unix:/home/gitlab/data/gitlab-workhorse/socket fail_timeout=0;
}
# 找到 （两处位置）
server_name YOUR_SERVER_FQDN;
# 修改为 自己配置好的域名
server_name gitlab.example.com;
配置完成后检查 nginx -t 是否正常，没问题重新载入配置，即可进入 gitlab 的 web 界面。
# 查看日志
gitlab-ctl tail
附：
容器中的 gitlab 的 ssh 的时候，遇到了一些问题：
网络的问题：
gitlab 是在容器中运行，但是我们使用 git 访问的时候，用的是 git@docker主机域名：用户名/仓库名的方式来访问的，这就带来了一个问题: 客户端用 ssh 访问的时候，访问到的是 Docker 主机的 22 端口，而不是容器中的 22 端口， 解决的方法是：将主机的 ssh 端口改为别的，然后容器启动的时候，将容器的 22 端口映射道主机的 22 端口，当然 Docker 主机所在的 22 端口要确保最终用户能够访问的到。
配置
upstream gitlab-workhorse {
server unix:/var/opt/gitlab/gitlab-workhorse/socket;
}
server{
listen 80;
server_name gitlab.xxxxx.com; ## 修改成自己的域名；
rewrite ^(.*)$ https://$host$request_uri;
}
## Normal HTTP host
server {
listen 443 ssl;
ssl_certificate /data/ssl/new/xxxxx.com/cert.pem;
ssl_certificate_key /data/ssl/new/xxxxx.com/key.pem;
server_name gitlab.xxxxxx.com; ## 修改成自己的域名；
root /opt/gitlab/embedded/service/gitlab-rails/public;
## See app/controllers/application_controller.rb for headers set
## Individual nginx logs for this GitLab vhost
access_log /var/logs/nginx/gitlab_access.log; # 根据实际情况修改
error_log /var/logs/nginx/gitlab_error.log; # 根据实际情况修改
location ~ ^/(assets)/ {
gzip_static on; # to serve pre-gzipped version
expires max;
add_header Cache-Control public;
}
location / {
client_max_body_size 0;
gzip off;
## https://github.com/gitlabhq/gitlabhq/issues/694
## Some requests take more than 30 seconds.
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://gitlab-workhorse;
}
}