0

I have a server with several virtual machines and one of those is my Proxy that direct the right domains to the right VM on the right port.

  1. I used the standard docker-compose file to create gitlab-ce and gitlab-runner
  2. I redirect by domain in the proxy to port 8080 in my docker VM

This all worked fine and I could login in my browser with https://gitlab.mydomain.de.

Now the problem: all links to runners and the links to clone repositories start with http://localhost instead of https://gitlab.mydomain.de.

The option GITLAB_OMNIBUS_CONFIG->external_url in the docker-compose file is containing http://localhost, so I changed that to https://gitlab.mydomain.de, stopped and restarted the docker containers

docker-compose down; docker-compose up

But this time I only get a 502 Bad Gateway error in the browser.

This is my proxy config:

server {
  listen 10.77.77.254:443 ssl;
  listen [2a01:4f8:241:1d02:0:77:77:254]:443 ssl;
  server_name gitlab.mydomain.de;
  include snippets.d/ssl_generic;
  ssl_certificate     /etc/letsencrypt/live/gitlab.mydomain.de/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/gitlab.mydomain.de/privkey.pem;
  include snippets.d/standard;
  location / {
      include                     snippets.d/proxy_generic;
      proxy_pass                  http://10.77.77.107:8080;
  }
}

This is my docker-compose.yml:

version: '3.7'
services:
  web:
    image: 'gitlab/gitlab-ce:latest'
    restart: always
    hostname: 'localhost'
    container_name: gitlab-ce
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.mydomin.de'
    ports:
      - '8080:80'
      - '8443:443'
    volumes:
      - '/var/docker/gitlab/config:/etc/gitlab'
      - '/var/docker/gitlab/logs:/var/log/gitlab'
      - '/var/docker/gitlab/data:/var/opt/gitlab'
    networks:
      - gitlab
  gitlab-runner:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner    
    restart: always
    depends_on:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - '/var/docker/gitlab/gitlab-runner:/etc/gitlab-runner'
    networks:
      - gitlab

networks:
  gitlab:
    name: gitlab-network

If I change

external_url 'https://gitlab.mydomain.de'

back to http

external_url 'http://gitlab.mydomain.de'

then the setup works again (but with the wrong URLs starting with only 'http://' now on the webinterface).

The problem seems to be the https in the external_url.

If I change the proxy_pass to http://10.77.77.107:8433 which is where the ssl port is presented to the host in the docker-compose file, then I get a 400 Bad Request error:

400 Bad Request The plain HTTP request was sent to HTTPS port

UPDATE: Here they say:

By default, when you specify external_url Omnibus GitLab will set a few NGINX proxy headers that are assumed to be sane in most environments.

For example, Omnibus GitLab will set:

"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"

if you have specified https schema in the external_url.

However, if you have a situation where your GitLab is in a more complex setup like behind a reverse proxy, you will need to tweak the proxy headers in order to avoid errors like The change you wanted was rejected or Can't verify CSRF token authenticity Completed 422 Unprocessable.

I tried overriding the default headers. In the docker-compose file in the omnibus section I added X-Forwarded-Proto: http:

environment:
  GITLAB_OMNIBUS_CONFIG: |
    external_url 'https://gitlab.mydomain.de'
    letsencrypt['enabled'] = false
    nginx['listen_port'] = 80
    nginx['proxy_set_headers'] = { "X-Forwarded-Proto" => "http", 'X-Forwarded-Ssl' => 'off' }

But this didn't help either

How do I solve this?

2
  • Do you set hostname in your compose file aswell?
    – Panki
    Commented Mar 26, 2022 at 14:24
  • @Panki, yes, I added my config above. I also tried setting hostname to gitlab.mydomain.de as well, but then I don`t get the webinterface again
    – rubo77
    Commented Mar 26, 2022 at 23:36

1 Answer 1

0

No need to override the default headers. In the docker-compose.yml file in the GITLAB_OMNIBUS_CONFIG section just add nginx['listen_https'] = false:

environment:
  GITLAB_OMNIBUS_CONFIG: |
    external_url 'https://gitlab.mydomain.de'
    letsencrypt['enabled'] = false
    nginx['listen_https'] = false
    nginx['listen_port'] = 80

This will disable SSL inside docker and your reverse_proxy can do the SSL-thing

see https://docs.gitlab.com/omnibus/settings/nginx.html#external-proxy-and-load-balancer-ssl-termination

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .