Home / server / Questions / 759501
In Process
user1255102
Asked: 2016-02-25 08:45:32 +0800 CST

Configure nginx to proxy GitLab CE (both a docker container)

  • 772

The two following docker containers are running on my machine: 

nginx                     0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp                               nginx
gitlab/gitlab-ce:latest   0.0.0.0:32782->22/tcp, 0.0.0.0:32781->80/tcp, 0.0.0.0:32780->443/tcp   gitlab

At the moment I cannot figure out how to configure nginx to reverse proxy the user request. If a user enters http://gitlab.domain.com my setup returns a 502 Bad Gateway Error.

Server config:
    server{
        listen 80;
        listen [::]:80;
        server_name gitlab.domain.com www.gitlab.domain.com;

        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header HOST $http_host;
            proxy_set_header X-NginX-Proxy true;

            proxy_pass http://gitlab:32781;
            proxy_redirect off;
        }
}
nginx

3 Answers

  1. For me worked following configuration for jwilder/nginx-proxy container.

    web:
  image: 'gitlab/gitlab-ce:latest'
  hostname: 'gitlab.it-expert.com.ua'
  environment:
    GITLAB_OMNIBUS_CONFIG: |
      external_url 'https://gitlab.it-expert.com.ua'
      registry_external_url 'https://registry.it-expert.com.ua'
    VIRTUAL_HOST: gitlab.it-expert.com.ua,registry.it-expert.com.ua
    VIRTUAL_PORT: 443
    VIRTUAL_PROTO: https
  volumes:
    - './data/config:/etc/gitlab'
    - './data/logs:/var/log/gitlab'
    - './data/data:/var/opt/gitlab'

    Tricky part was to figure out how containers is connected and which and who should process SSL.

    For this configuration you should supply SSL certificates both for nginx-proxy and gitlab-ce containers, because communications between them is also using SSL. For gitlab-ce use ./data/config/ssl folder.

    You can find out in my blog post how to quickly get valid certificate from Let's encrypt via handy docker container certbot.

    • 2

  2. Here is a working docker-compose.yml:

    gitlab:                                                                                                                                                                
  image: "gitlab/gitlab-ce:latest"
  container_name: gitlab                                                                                                                            
  volumes:
    - ./gitlab/config:/etc/gitlab
    - ./gitlab/logs:/var/log/gitlab
    - ./gitlab/data:/var/opt/gitlab
    - /home/user/nginx-proxy/certs:/etc/gitlab/ssl/
  environment:
    GITLAB_OMNIBUS_CONFIG: |
      external_url 'https://git.example.org'                                                                                                                    
    VIRTUAL_HOST: git.example.org
    VIRTUAL_PORT: 443
    VIRTUAL_PROTO: https
    LETSENCRYPT_HOST: git.example.org
    LETSENCRYPT_EMAIL: [email protected]
  restart: always

    Using jwilder/nginx-proxy container as Max Prokopov answer. The critical part for my case was VIRTUAL_PORT and VIRTUAL_PROTO environment variables. Don't setting them propretly cause Nginx 400 error: "The plain HTTP request was sent to HTTPS port".

    Here is a spinet for the gitlab part of conf.d/default.conf nginx file:

    upstream git.example.org {
                                ## Can be connect with "bridge" network
                        # gitlab
                        server 172.17.0.4:443;
}
server {
        server_name git.example.org;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        return 301 https://$host$request_uri;
}
server {
        server_name git.example.org;
        listen 443 ssl http2 ;
        access_log /var/log/nginx/access.log vhost;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ...;
        ssl_certificate /etc/nginx/certs/git.example.org.crt;
        ssl_certificate_key /etc/nginx/certs/igit.example.org.key;
        ssl_dhparam /etc/nginx/certs/git.example.org.dhparam.pem;
        add_header Strict-Transport-Security "max-age=31536000";
        include /etc/nginx/vhost.d/default;
        location / {
                proxy_pass https://git.example.org;
        }
}
    • 0

  3. you don't need to map gitlab container ports to host port because nginx container knows other container, and try 

    proxy_pass http://gitlab;

    You have to link the container before into run command of nginx container

    --link gitlab:gitlab
    • -1