0

I am not a server admin, so I do not configure Apache Servers on a daily basis.

But I want to use Gitlab on our server with SSL and Apache 2.4.6. (httpd on CentOS 7).

So far I have added the certificates (.pem) and turned on SSL.

head -30 /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml

gitlab:
    ## Web server settings (note: host is the FQDN, do not include http://)
    host: gitlab.my-domain.org
    port: 443
    https: true

    # The maximum time unicorn/puma can spend on the request. This needs to be smaller than the worker timeout.
    # Default is 95% of the worker timeout
    max_request_duration_seconds: 57

The Apache Configuration:

<IfModule mod_ssl.c>
<VirtualHost *:443>  
  ServerName gitlab.my-domain.org
  ServerSignature Off

  ProxyPreserveHost On
  ProxyTimeout 60
  AllowEncodedSlashes NoDecode

  SSLEngine on
  SSLProxyEngine on
  SSLCertificateFile /etc/letsencrypt/live/some-original-domain/cert.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/some-original-domain/privkey.pem
  Include /etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateChainFile /etc/letsencrypt/live/some-original-domain/chain.pem

  <Location />
    # New authorization commands for apache 2.4 and up
    # http://httpd.apache.org/docs/2.4/upgrading.html#access
    Require all granted
    ProxyPassReverse http://127.0.0.1:8080
    ProxyPassReverse https://gitlab.my-domain.org/
  </Location>

  RewriteEngine on
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
  RewriteCond %{REQUEST_URI} ^/uploads/.*
  RewriteRule .* https://127.0.0.1:8080%{REQUEST_URI} [P,QSA]

  RequestHeader set X_FORWARDED_PROTO 'https'
  RequestHeader set X-Forwarded-Ssl on

  # needed for downloading attachments
  DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

  #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
  # ErrorDocument 404 /404.html
  # ErrorDocument 422 /422.html
  # ErrorDocument 500 /500.html
  # ErrorDocument 503 /deploy.html

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog  /var/log/httpd/gitlab.my-domain_error.log
  CustomLog /var/log/httpd/gitlab.my-domain_forwarded.log common_forwarded
  CustomLog /var/log/httpd/gitlab.my-domain_access.log combined env=!dontlog
  CustomLog /var/log/httpd/gitlab.my-domain.log combined

</VirtualHost>
</IfModule>

There must be some misconfiguration, I only see:

 [proxy_http:error] [pid 18466] (103)Software caused connection abort: [client {IP}:32906] AH01102: error reading status line from remote server 127.0.0.1:8080
[proxy:error] [pid 18466] [client {IP}:32906] AH00898: Error reading from remote server returned by /

And I do not understand the <location> part of this configuration in

Also for wget http://localhost:8080/api/v3/internal/check on the server

{....} connection refused
ERROR 410: Gone.

Finally gitlab-rake gitlab:check:

Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 13.7.0 ? ... OK (13.7.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ... 
GitLab Instance / Monitoring ... yes
sdp-dev / sdp-services ... yes
sdp-dev / co2compass-app ... yes
sdp-dev / sdp-api ... yes
sdp-dev / sdp-ops ... yes
Redis version >= 4.0.0? ... yes
Ruby version >= 2.5.3 ? ... yes (2.6.6)
Git version >= 2.24.0 ? ... yes (2.28.0)
Git user has default SSH configuration? ... yes
Active users: ... 3
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes

Checking GitLab App ... Finished


Checking GitLab subtasks ... Finished

I think it is not a timeout issue, because the whole request from my browser takes ~150ms. I was able to reach the Gitlab instance via http before.

Any idea?

Edit: netstat

In order to clarify, whether Gitlab should be available under 127.0.0.1:8080, I think the service is available there.

netstat -tupln

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    

tcp        0      0 127.0.0.1:9229          0.0.0.0:*               LISTEN      28566/gitlab-workho                  
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      6202/puma: cluster  
tcp        0      0 127.0.0.1:9168          0.0.0.0:*               LISTEN      28564/puma 4.3.5.gi         
tcp        0      0 127.0.0.1:8082          0.0.0.0:*               LISTEN      28846/sidekiq 5.2.9 
tcp        0      0 127.0.0.1:9236          0.0.0.0:*               LISTEN      28523/gitaly                   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      4950/httpd           
tcp6       0      0 ::1:9168                :::*                    LISTEN      28564/puma 4.3.5.gi
BairDev
  • 125
  • 1
  • 1
  • 8
  • Why do this at all? Just run GitLab CE omnibus. It has everything including a web server built in and configured. – Michael Hampton Feb 02 '21 at 12:01
  • @MichaelHampton I think the problem is replacing NGINX with Apache. When I don't find a solution I will give Omnibus a trial. – BairDev Feb 04 '21 at 11:21
  • Don't replace nginx then. There shouldn't be anything else on the machine anyway. – Michael Hampton Feb 04 '21 at 12:03
  • Well. Gitlab is just one among other services on the server. And it should be able to run with Apache instead of NGINX, since Apache is needed for all other setups. I do not want to move my load of problems to other services, because Gitlab is stubborn. – BairDev Feb 04 '21 at 12:36

2 Answers2

0

I've never set up Gitlab instances before but it looks like you have configured Gitlab to listen on 127.0.0.1:443, rather than 127.0.0.1:8080 as configured in your apache configuration file.

You're setting up a reverse proxy with apache, the web trafic goes like this :

Gitlab (http://127.0.0.1:8080) -> Apache Reverse proxy -> https://gitlab.my-domain.com/

So in your Gitlab config file, change

port: 443

to

port: 8080
Storca
  • 1
0

There was a problem in the Apache configuration:

RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]

instead of https://...

The other change I've made was adding

SSLCompression Off

but I am not sure at all regarding its impact.

Anyway, now it works fine.

BairDev
  • 125
  • 1
  • 1
  • 8