1

I am trying to configure Nginx on one server to route to a default GitLab installation on another server (192.168.1.3) through reverse proxy such that GitLab would work at the path http://myserver/gitlab, https://myserver/gitlab, http://192.168.1.3, and https://192.168.1.3. However, I think I ran into trouble since the server with GitLab also use Nginx as its own reverse proxy. Thus, I am not sure how to configure Nginx on both servers for GitLab to work properly.

Here is the current Nginx's configuration on the main Nginx server:

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

    server_name myserver;

    location / {
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass $scheme://192.168.1.4;
    }

    location ~/gitlab/(.*)$ {
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass $scheme://192.168.1.3/$1;
    }
}

Here is the default Nginx's configuration on the GitLab server:

upstream gitlab {
    server unix:/home/git/gitlab/tmp/sockets/gitlab.socket fail_timeout=0;
}

upstream gitlab-workhorse {
    server unix:/home/git/gitlab/tmp/sockets/gitlab-workhorse.socket fail_timeout=0;
}

server {
    listen 0.0.0.0:80;
    include /etc/nginx/include/gitlab-proxy;
}

server {
    listen 0.0.0.0:443 ssl;
    include /etc/nginx/include/ssl;
    include /etc/nginx/include/gitlab-proxy;
}

Here is what is on /etc/nginx/include/gitlab-proxy:

root /home/git/gitlab/public;

access_log /var/log/nginx/gitlab.access.log;
error_log /var/log/nginx/gitlab.error.log;

location / {
    try_files $uri $uri/index.html $uri.html @gitlab;
}

location @gitlab {
    proxy_set_header HOST $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_pass http://gitlab;
    proxy_redirect off;
    proxy_buffering off;
}

location ~ [-\/\w\.]+\.git\/ {
    proxy_set_header HOST $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_pass http://gitlab-workhorse;
    proxy_redirect off;
    proxy_buffering off;

    proxy_connect_timeout 300;
    proxy_read_timeout 300;
}

The host name of gitlab is addressed to 127.0.0.1 on the GitLab server.

FYI, this question is similar to the question here except that it is asking for SSL in particular. The GitLab environment GITLAB_RELATIVE_URL_ROOT is changed. It is something I don't know how to change or even want to change as I want it to be still accessible via http://192.168.1.3 and https://192.168.1.3. Also, it uses Docker container for Nginx.

  • What exactly is the problem? What is the curl -v output of a problematic request? Does it work in any way? – Tero Kilkanen Apr 27 '18 at 4:29
  • I can visit website from 192.168.1.4 perfectly fine. The problem occurred for only GitLab server. If I visit http:// myserver/gitlab, it redirects me to http:// myserver/users/sign_in, which is 404 error. This isn't correct as I only port forward to the main Nginx server. The URL is unrecognizable; it supposed to be http:// myserver/gitlab/users/sign_in. On the other hand, if I visit https:// myserver/gitlab, I got a secure connection failed. Of course, if I visit http:// 192.168.1.3 or https:// 192.168.1.3, both of which correctly redirects me to http:// 192.168.1.3/users/sign_in. – Ice Drake Apr 27 '18 at 5:17
  • I assume the problem is in the fact that GitLab expects that only one URL is used to access it, which would be for example http://example.com/gitlab. That would mean that you would have to find a way to provide a virtual host with that name for both your 192.168.1.0/24 network and the other network. I would try setting up a reverse proxy on the 192.168.1.3 server with the virtual host, and then use some split DNS configuration to provide different IP addresses for the domain name providing correct IP addresses to each network. But this is only an educated guess from me. – Tero Kilkanen Apr 28 '18 at 9:49
  • I have made some progress now. I manually install GitLab Omnibus rather than using the built-in GitLab package from TurnKey Linux and was able to setup it to work at myserver/gitlab and made a compromise with 192.168.1.3/gitlab. Modified configuration on Nginx server from location ~/gitlab/(.*)$ to location ~/gitlab(.*)$ and proxy_pass $scheme://192.168.1.3/$1; to proxy_pass $scheme://192.168.1.3/gitlab$1;. However, I stumbled upon a different problem. I can't git clone/pull/push via Nginx reverse proxy. It keeps giving me 403 error. I can do it via 192.168.1.3 though. – Ice Drake May 2 '18 at 1:23
  • Open a new question with proper details and people can answer there. – Tero Kilkanen May 2 '18 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.