index.md 9.5 KB
Newer Older
1
# GitLab Pages administration
2 3

> **Notes:**
4 5 6 7 8
- [Introduced][ee-80] in GitLab EE 8.3.
- Custom CNAMEs with TLS support were [introduced][ee-173] in GitLab EE 8.5.
- GitLab Pages [were ported][ce-14605] to Community Edition in GitLab 8.17.
- This guide is for Omnibus GitLab installations. If you have installed
  GitLab from source, follow the [Pages source installation document](source.md).
9
- To learn how to use GitLab Pages, read the [user documentation][pages-userguide].
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

---

This document describes how to set up the _latest_ GitLab Pages feature. Make
sure to read the [changelog](#changelog) if you are upgrading to a new GitLab
version as it may include new features and changes needed to be made in your
configuration.

## Overview

GitLab Pages makes use of the [GitLab Pages daemon], a simple HTTP server
written in Go that can listen on an external IP address and provide support for
custom domains and custom certificates. It supports dynamic certificates through
SNI and exposes pages using HTTP2 by default.
You are encouraged to read its [README][pages-readme] to fully understand how
it works.

---

In the case of custom domains, the Pages daemon needs to listen on ports `80`
and/or `443`. For that reason, there is some flexibility in the way which you
can set it up:

33
1. Run the pages daemon in the same server as GitLab, listening on a secondary IP.
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49
1. Run the pages daemon in a separate server. In that case, the
   [Pages path](#change-storage-path) must also be present in the server that
   the pages daemon is installed, so you will have to share it via network.
1. Run the pages daemon in the same server as GitLab, listening on the same IP
   but on different ports. In that case, you will have to proxy the traffic with
   a loadbalancer. If you choose that route note that you should use TCP load
   balancing for HTTPS. If you use TLS-termination (HTTPS-load balancing) the
   pages will not be able to be served with user provided certificates. For
   HTTP it's OK to use HTTP or TCP load balancing.

In this document, we will proceed assuming the first option.

## Prerequisites

Before proceeding with the Pages configuration, you will need to:

50 51 52 53 54
1. Have a separate domain under which the GitLab Pages will be served. In this
   document we assume that to be `example.io`.
1. Configure a **wildcard DNS record**.
1. (Optional) Have a **wildcard certificate** for that domain if you decide to
   serve Pages under HTTPS.
55
1. (Optional but recommended) Enable [Shared runners](../../ci/runners/README.md)
56
   so that your users don't have to bring their own.
57 58 59 60 61 62 63 64

### DNS configuration

GitLab Pages expect to run on their own virtual host. In your DNS server/provider
you need to add a [wildcard DNS A record][wiki-wildcard-dns] pointing to the
host that GitLab runs. For example, an entry would look like this:

```
65
*.example.io. 1800 IN A 1.1.1.1
66 67 68
```

where `example.io` is the domain under which GitLab Pages will be served
69
and `1.1.1.1` is the IP address of your GitLab instance.
70 71 72 73 74 75 76 77 78

> **Note:**
You should not use the GitLab domain to serve user pages. For more information
see the [security section](#security).

[wiki-wildcard-dns]: https://en.wikipedia.org/wiki/Wildcard_DNS_record

## Configuration

79 80 81 82
Depending on your needs, you can set up GitLab Pages in 4 different ways.
The following options are listed from the easiest setup to the most
advanced one. The absolute minimum requirement is to set up the wildcard DNS
since that is needed in all configurations.
83

84
### Wildcard domains
85

86 87 88 89 90 91
>**Requirements:**
- [Wildcard DNS setup](#dns-configuration)
>
>---
>
URL scheme: `http://page.example.io`
92

93 94 95
This is the minimum setup that you can use Pages with. It is the base for all
other setups as described below. Nginx will proxy all requests to the daemon.
The Pages daemon doesn't listen to the outside world.
96

97
1. Set the external URL for GitLab Pages in `/etc/gitlab/gitlab.rb`:
98 99

    ```ruby
100
    pages_external_url 'http://example.io'
101 102 103 104
    ```

1. [Reconfigure GitLab][reconfigure]

105
### Wildcard domains with TLS support
106

107 108 109 110 111 112 113
>**Requirements:**
- [Wildcard DNS setup](#dns-configuration)
- Wildcard TLS certificate
>
>---
>
URL scheme: `https://page.example.io`
114

115 116
Nginx will proxy all requests to the daemon. Pages daemon doesn't listen to the
outside world.
117

118 119
1. Place the certificate and key inside `/etc/gitlab/ssl`
1. In `/etc/gitlab/gitlab.rb` specify the following configuration:
120 121

    ```ruby
122 123 124 125 126
    pages_external_url 'https://example.io'

    pages_nginx['redirect_http_to_https'] = true
    pages_nginx['ssl_certificate'] = "/etc/gitlab/ssl/pages-nginx.crt"
    pages_nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/pages-nginx.key"
127 128
    ```

129 130
    where `pages-nginx.crt` and `pages-nginx.key` are the SSL cert and key,
    respectively.
131 132 133

1. [Reconfigure GitLab][reconfigure]

134
## Advanced configuration
135

136 137 138 139
In addition to the wildcard domains, you can also have the option to configure
GitLab Pages to work with custom domains. Again, there are two options here:
support custom domains with and without TLS certificates. The easiest setup is
that without TLS certificates.
140

141
### Custom domains
142

143 144 145 146 147 148 149
>**Requirements:**
- [Wildcard DNS setup](#dns-configuration)
- Secondary IP
>
---
>
URL scheme: `http://page.example.io` and `http://domain.com`
150

151 152 153
In that case, the pages daemon is running, Nginx still proxies requests to
the daemon but the daemon is also able to receive requests from the outside
world. Custom domains are supported, but no TLS.
154

155 156 157 158 159 160 161
1. Edit `/etc/gitlab/gitlab.rb`:

    ```ruby
    pages_external_url "http://example.io"
    nginx['listen_addresses'] = ['1.1.1.1']
    pages_nginx['enable'] = false
    gitlab_pages['external_http'] = '1.1.1.2:80'
162 163
    ```

164 165
    where `1.1.1.1` is the primary IP address that GitLab is listening to and
    `1.1.1.2` the secondary IP where the GitLab Pages daemon listens to.
166 167 168

1. [Reconfigure GitLab][reconfigure]

169
### Custom domains with TLS support
170

171 172 173 174 175 176 177 178
>**Requirements:**
- [Wildcard DNS setup](#dns-configuration)
- Wildcard TLS certificate
- Secondary IP
>
---
>
URL scheme: `https://page.example.io` and `https://domain.com`
179

180 181 182
In that case, the pages daemon is running, Nginx still proxies requests to
the daemon but the daemon is also able to receive requests from the outside
world. Custom domains and TLS are supported.
183

184
1. Edit `/etc/gitlab/gitlab.rb`:
185 186

    ```ruby
187 188 189 190 191 192 193
    pages_external_url "https://example.io"
    nginx['listen_addresses'] = ['1.1.1.1']
    pages_nginx['enable'] = false
    gitlab_pages['cert'] = "/etc/gitlab/ssl/example.io.crt"
    gitlab_pages['cert_key'] = "/etc/gitlab/ssl/example.io.key"
    gitlab_pages['external_http'] = '1.1.1.2:80'
    gitlab_pages['external_https'] = '1.1.1.2:443'
194 195
    ```

196 197 198
    where `1.1.1.1` is the primary IP address that GitLab is listening to and
    `1.1.1.2` the secondary IP where the GitLab Pages daemon listens to.

199 200 201 202 203 204
1. [Reconfigure GitLab][reconfigure]

## Change storage path

Follow the steps below to change the default path where GitLab Pages' contents
are stored.
205

206 207 208
1. Pages are stored by default in `/var/opt/gitlab/gitlab-rails/shared/pages`.
   If you wish to store them in another location you must set it up in
   `/etc/gitlab/gitlab.rb`:
209

210 211 212
     ```ruby
     gitlab_rails['pages_path'] = "/mnt/storage/pages"
     ```
213 214 215

1. [Reconfigure GitLab][reconfigure]

216
## Set maximum pages size
217

218 219 220
The maximum size of the unpacked archive per project can be configured in the
Admin area under the Application settings in the **Maximum size of pages (MB)**.
The default is 100MB.
221 222 223 224 225 226 227 228 229 230

## Backup

Pages are part of the [regular backup][backup] so there is nothing to configure.

## Security

You should strongly consider running GitLab pages under a different hostname
than GitLab to prevent XSS attacks.

231 232 233 234 235 236 237 238 239 240
## Changelog

GitLab Pages were first introduced in GitLab EE 8.3. Since then, many features
where added, like custom CNAME and TLS support, and many more are likely to
come. Below is a brief changelog. If no changes were introduced or a version is
missing from the changelog, assume that the documentation is the same as the
latest previous version.

---

241
**GitLab 8.17 ([documentation][8-17-docs])**
242

243
- GitLab Pages were ported to Community Edition in GitLab 8.17.
244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260
- Documentation was refactored to be more modular and easy to follow.

**GitLab 8.5 ([documentation][8-5-docs])**

- In GitLab 8.5 we introduced the [gitlab-pages][] daemon which is now the
  recommended way to set up GitLab Pages.
- The [NGINX configs][] have changed to reflect this change. So make sure to
  update them.
- Custom CNAME and TLS certificates support.
- Documentation was moved to one place.

**GitLab 8.3 ([documentation][8-3-docs])**

- GitLab Pages feature was introduced.

[8-3-docs]: https://gitlab.com/gitlab-org/gitlab-ee/blob/8-3-stable-ee/doc/pages/administration.md
[8-5-docs]: https://gitlab.com/gitlab-org/gitlab-ee/blob/8-5-stable-ee/doc/pages/administration.md
261
[8-17-docs]: https://gitlab.com/gitlab-org/gitlab-ce/blob/8-17-stable-ce/doc/administration/pages/index.md
262
[backup]: ../../raketasks/backup_restore.md
263
[ce-14605]: https://gitlab.com/gitlab-org/gitlab-ce/issues/14605
264 265 266 267 268 269
[ee-80]: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/80
[ee-173]: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/173
[gitlab pages daemon]: https://gitlab.com/gitlab-org/gitlab-pages
[NGINX configs]: https://gitlab.com/gitlab-org/gitlab-ee/tree/8-5-stable-ee/lib/support/nginx
[pages-readme]: https://gitlab.com/gitlab-org/gitlab-pages/blob/master/README.md
[pages-userguide]: ../../user/project/pages/index.md
270 271
[reconfigure]: ../restart_gitlab.md#omnibus-gitlab-reconfigure
[restart]: ../restart_gitlab.md#installations-from-source
272
[gitlab-pages]: https://gitlab.com/gitlab-org/gitlab-pages/tree/v0.2.4