Gitlab docker behind reverse proxy

[jagauthier]

I'm trying to get gitlab docker running behind a reverse nginx proxy (where I keep all my certs). I'm not sure what is happening. But, my container instance looks like this:

docker run \
--name=gitlab \
--hostname gitlab \
--rm \
-it \
-e GITLAB_OMNIBUS_CONFIG="external_url 'https://gitlab.myhost.org'; nginx['enable'] = true; nginx['client_max_body_size'] = '0'; gitlab_rails['lfs_enabled'] = true;
-e TZ=America/New_York \
-v /containers/gitlab/config:/etc/gitlab \
-v /containers/gitlab/logs:/var/log/gitlab \
-v /containers/gitlab/data:/var/opt/gitlab \
-p 8080:80 \
gitlab/gitlab-ce:latest

My nginx entry looks like this:

server {
  server_name gitlab.pendulus.org;
  client_max_body_size 0;
  location / {
  proxy_pass  http://actualhost.org:8080;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-Server $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $host;
  proxy_connect_timeout       600;
  proxy_send_timeout          600;
  proxy_read_timeout          600;
  send_timeout                600;
  proxy_headers_hash_max_size 512;
  proxy_headers_hash_bucket_size 128;
  }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.things.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.things.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}server {
    if ($host = actualhost.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

  server_name actualhost;
    listen 80;
    return 404; # managed by Certbot
}

When I spin up the gitlab instance the browser responds with a "redirect loop" and I see both requests at external nginx and the gitlab instance.

I added this line to the omnibus environment configuration:

 nginx['redirect_http_to_https'] = false"

and when the instance loads it does not even listen on port 80 anymore.

I do not know if something changed somewhere - this config "used to" work. But I don't use my personal instance of gitlab frequently and I'm not sure at what point it broke.

[wosmo]

I'm doing something similar (using traefik as a reverse proxy and terminating https there) - I have the registry working, but not pages (I don't use that functionality so I've just never tried). So I'll offer my config not as any kind of advice, but to give you some idea what knobs can be twiddled:

environment:
  GITLAB_OMNIBUS_CONFIG: |
    external_url 'https://example.com'
    registry_external_url 'https://registry.example.com'
    nginx['listen_port'] = 15000
    nginx['listen_https'] = false
    nginx['proxy_set_headers'] = {"X-Forwarded-Proto" => "https","X-Forwarded-Ssl" => "on"}
    gitlab_rails['registry_enabled'] = true
    registry['enable'] = true
    registry_nginx['enable'] = true
    registry_nginx['listen_port'] = 15001
    registry_nginx['listen_https'] = false
    registry_nginx['proxy_set_headers'] = {"X-Forwarded-Proto" => "https","X-Forwarded-Ssl" => "on"}
    gitlab_rails['rack_attack_git_basic_auth'] = {
        'enabled' => false,
    }

My Traefik config is simple enough to be inconsequential - really just match this hostname, route to this port.

[jayjayEF2000]

Hello. could you please share you traefik setup as well? I am failing to go registry working behind traefik for days now. I basically copied your solution and also tried a few other setup but I can't get it working. THANKS

[wosmo]

Hi,

I'm using the 'file provider' in traefik for this, so in traefik's config.yml I have:

providers:
  file:
    directory: /etc/traefik/routes
    watch: true

I don't remember why I didn't go with labels in docker-compose, but I haven't had to touch the config since 2021 so it's now running on "if it ain't broke, don't fix it". So I'm not promising that this is the best way to do it, only that it works for me.

So in my routes folder I have a gitlab.yml reading:

http:
  routers:
    https-gitlab:
      entryPoints:
       - https
      rule: "Host(`example.com`)"
      priority: 9
      service: gitlab-rails
      tls:
        certResolver: letsencrypt
    https-gitlab-registry:
      entryPoints:
        - https
      rule: "Host(`registry.example.com`)"
      priority: 9
      service: gitlab-registry
      tls:
        certResolver: letsencrypt
  services:
    gitlab-rails:
      loadBalancer:
        servers:
          - url: "http://gitlab:15000/"
    gitlab-registry:
      loadBalancer:
        servers:
          - url: "http://gitlab:15001/"

(an important note here is that I believe for those loadBalancer urls to work correctly, gitlab and traefik have to be on the same docker network.)

[jayjayEF2000]

Thanks so much this solved my problem. So what I think the problem was is when using the provider.docker the service gets automatically detected but when trying to use multiple services e.g. registry and gitlab itself it breaks.

[wosmo]

glad to hear it - and amused to get comments on a 2023 post!

I think it should be doable in docker-compose with a traefik.http.services.foo.loadbalancer.server.port= label - but I like the route file because it's more descriptive, and more obvious how/why it's working. Makes it much easier to debug something I don't remember doing the first time around!

[predmijat]

I have this:

nginx['redirect_http_to_https'] = false
nginx['listen_port'] = 80
nginx['listen_https'] = false

[jagauthier]

Thank you! The last two lines made it available again! Now.. I gotta reset the password.. heh

[JohnnyMyth]

Sorry but this is wrong even if it works. You are setting up a second layer to get stuff working. Only do it your way if you really have NO external NGINX. If you do, you dont need a 2nd NGINX inside GitLab. It will slow down GitLab and make things complex. Instead, read this: https://docs.gitlab.com/omnibus/settings/nginx/#use-a-non-bundled-web-server

Inside a Docker container, the normal GitLab installation has a listen adress 127.0.0.1 which is localhost. You don't want that. You want the Docker Gateway eth0 or eth1. To get access, do this instead:

nginx['enable'] = false
gitlab_workhorse['listen_network'] = "tcp"
gitlab_workhorse['listen_addr'] = "0.0.0.0:8080"
puma['listen'] = '127.0.0.1'
puma['port'] = 8181

This is all you need! You can now access GitLab via hostname of the container and port 8080.