Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
c13d4477
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
c13d4477
编写于
8月 04, 2014
作者:
J
Jacob Vosmaer
浏览文件
操作
浏览文件
下载
差异文件
Merge branch 'simplify-ssl-setup' into 'master'
Simplify ssl setup /cc @dzaporozhets Fixes #1409 See merge request !1006
上级
833bc305
8aff39a6
变更
2
隐藏空白更改
内联
并排
Showing
2 changed file
with
30 addition
and
59 deletion
+30
-59
lib/support/nginx/gitlab
lib/support/nginx/gitlab
+3
-3
lib/support/nginx/gitlab-ssl
lib/support/nginx/gitlab-ssl
+27
-56
未找到文件。
lib/support/nginx/gitlab
浏览文件 @
c13d4477
...
...
@@ -20,9 +20,9 @@ upstream gitlab {
}
server {
listen *:80 default_server;
# e.g., listen 192.168.1.1:80; In most cases *:80 is a good idea
server_name YOUR_SERVER_FQDN;
# e.g., server_name source.example.com;
server_tokens off;
# don't show the
version number, a security best practice
listen *:80 default_server;
server_name YOUR_SERVER_FQDN;
## Replace this with something like gitlab.example.com
server_tokens off;
## Don't show the nginx
version number, a security best practice
root /home/git/gitlab/public;
# Increase this if you want to upload large attachments
...
...
lib/support/nginx/gitlab-ssl
浏览文件 @
c13d4477
...
...
@@ -3,33 +3,11 @@
##
## Modified from nginx http version
## Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
## Modified from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
##
## Lines starting with two hashes (##) are comments containing information
## for configuration. One hash (#) comments are actual configuration parameters
## which you can comment/uncomment to your liking.
##
###################################
## SSL configuration ##
###################################
##
## Optimal configuration is taken from:
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
## Make sure to read it and understand what each option does.
##
## [Optional] Generate a self-signed ssl certificate:
## mkdir /etc/nginx/ssl/
## cd /etc/nginx/ssl/
## sudo openssl req -newkey rsa:2048 -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
## sudo chmod o-r gitlab.key
##
## Edit `gitlab-shell/config.yml`:
## 1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
## 2) Set "ca_file" to `/etc/nginx/ssl/gitlab.crt`
## 3) Set "self_signed_cert" to `true`
## Edit `gitlab/config/gitlab.yml`:
## 1) Define port for http "port: 443"
## 2) Enable https "https: true"
## 3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"
## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters.
## The last category can be commented/uncommented to your liking.
##
##################################
## CHUNKED TRANSFER ##
...
...
@@ -48,33 +26,41 @@
## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
## [1] https://github.com/agentzh/chunkin-nginx-module#status
## [2] https://github.com/agentzh/chunkin-nginx-module
##
###################################
## SSL file editing ##
###################################
##
## Edit `gitlab-shell/config.yml`:
## 1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
## 2) Set "ca_file" to `/etc/nginx/ssl/gitlab.crt`
## 3) Set "self_signed_cert" to `true`
## Edit `gitlab/config/gitlab.yml`:
## 1) Define port for http "port: 443"
## 2) Enable https "https: true"
## 3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"
##
###################################
## SSL configuration ##
###################################
##
upstream gitlab {
## Uncomment if you have set up unicorn to listen on a unix socket (recommended).
server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
## Uncomment if unicorn is configured to listen on a tcp port.
## Check the port number in /home/git/gitlab/config/unicorn.rb
# server 127.0.0.1:8080;
}
## This is a normal HTTP host which redirects all traffic to the HTTPS host.
server {
listen *:80;
## Replace git.example.com with your FQDN.
server_name git.example.com;
server_tokens off;
## root doesn't have to be a valid path since we are redirecting
root /nowhere;
listen *:80 default_server;
server_name YOUR_SERVER_FQDN; ## Replace this with something like gitlab.example.com
server_tokens off; ## Don't show the nginx version number, a security best practice
root /nowhere; ## root doesn't have to be a valid path since we are redirecting
rewrite ^ https://$server_name$request_uri permanent;
}
server {
listen 443 ssl;
## Replace git.example.com with your FQDN.
server_name git.example.com;
server_name YOUR_SERVER_FQDN; ## Replace this with something like gitlab.example.com
server_tokens off;
root /home/git/gitlab/public;
...
...
@@ -93,22 +79,7 @@ server {
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache builtin:1000 shared:SSL:10m;
## Enable OCSP stapling to reduce the overhead and latency of running SSL.
## Replace with your ssl_trusted_certificate. For more info see:
## - https://medium.com/devops-programming/4445f4862461
## - https://www.ruby-forum.com/topic/4419319
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
resolver 208.67.222.222 208.67.222.220 valid=300s;
resolver_timeout 10s;
ssl_prefer_server_ciphers on;
## [Optional] Generate a stronger DHE parameter (recommended):
## cd /etc/ssl/certs
## openssl dhparam -out dhparam.pem 2048
##
# ssl_dhparam /etc/ssl/certs/dhparam.pem;
add_header Strict-Transport-Security max-age=63072000;
add_header X-Frame-Options DENY;
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录