Installer un sous-domaine Apache GitLab sur Debian10

Vous voulez être indépendant de GitHub? C’est bien ici, suivez le guide…

Commençons par les mises à jour et les dépendances:

sudo apt update && sudo apt upgrade
sudo apt install ca-certificates curl openssh-server postfix

Si vous n’avez pas (ou pas encore) mis en place un serveur mail , choisissez “Internet Site” au moment de la configuration de Postfix, le reste de la configuration se fera seul en enchainant les touches “ENTER”.

Installation de Gitlab CE:

cd /tmp
sudo wget https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh
sudo bash script.deb.sh
sudo apt update
sudo apt install gitlab-ce

Pas de problème on va régler ça , on avance…

sudo nano /etc/gitlab/gitlab.rb

external_url 'http://gitlab.$NomDeDomaine'
letsencrypt['contact_emails'] = ['$MAIL']
web_server['external_users'] = ['www-data']
nginx['enable'] = false
gitlab_workhorse['listen_network'] = "tcp"
gitlab_workhorse['listen_addr'] = "127.0.0.1:8181"
gitlab_workhorse['auth_backend'] = "http://localhost:8080"

Et reconfiguez GitLab (5 bonnes minutes):

sudo gitlab-ctl reconfigure

Configuration de Apache:

cd /etc/apache2/sites-available
sudo nano $NomDeDomaine.gitlab.conf

<VirtualHost *:80>
        ServerName gitlab.$NomDeDomaine
        ServerSignature Off
        ProxyPreserveHost On

        # Ensure that encoded slashes are not decoded but left in their encoded state.
        # http://doc.gitlab.com/ce/api/projects.html#get-single-project
        AllowEncodedSlashes NoDecode

        <Location />
                # New authorization commands for apache 2.4 and up
                # http://httpd.apache.org/docs/2.4/upgrading.html#access
                Require all granted

                #Allow forwarding to gitlab-workhorse
                ProxyPassReverse http://127.0.0.1:8181
                ProxyPassReverse http://gitlab.$NomDeDomaine/
        </Location>

        # Apache equivalent of nginx try files
        # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
        # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
        RewriteEngine on

        #Forward all requests to gitlab-workhorse except existing files like error documents
        RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
        RewriteCond %{REQUEST_URI} ^/uploads/.*
        RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]

        # needed for downloading attachments
        DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

        #Set up apache error documents, if back end goes down (i.e. 503 error) then a
        #maintenance/deploy page is thrown up.
        ErrorDocument 404 /404.html
        ErrorDocument 422 /422.html
        ErrorDocument 500 /500.html
        ErrorDocument 502 /502.html
        ErrorDocument 503 /503.html

        # It is assumed that the log directory is in /var/log/httpd. For Debian
        # distributions you might want to change this to /var/log/apache2.
        LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
        ErrorLog /var/log/gitlab_error.log
        CustomLog /var/log/gitlab_forwarded.log common_forwarded
        CustomLog /var/log/gitlab_access.log combined env=!dontlog
        CustomLog /var/log/gitlab.log combined
</VirtualHost>

sudo a2ensite $NomDeDomaine.gitlab.conf
sudo a2enmod proxy_http
sudo a2enmod rewrite
sudo a2enmod headers
sudo service apache2 restart

sudo nano /etc/fail2ban/jail.local

Et ajouter:

[gitlab]
enabled = true

sudo nano /etc/init.d/firewall

Et collez:

# Autoriser GitLab
iptables -t filter -A INPUT -p tcp --dport 8181 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 8181 -j ACCEPT

Et redémarrer le firewall:

sudo /etc/init.d/firewall stop
sudo /etc/init.d/firewall start

Si vous avez suivi l’article concernant la mise en place des certificats Let’s Encrypt et https vous pouvez:

sudo certbot --apache -d gitlab.$NomDeDomaine -d gitlab.$NomDeDomaine

Rendez-vous sur: http://gitlab.$NomDeDomaine

Reset mot de passe root:

sudo gitlab-rails console -e production
user = User.find_by_username 'root'
user.password = '$PASSWORD'
user.password_confirmation = '$PASSWORD'
user.save!