CentOS6.5部署Gitlab-CE代码托管服务

安装要求

https://docs.gitlab.com/ce/install/requirements.html

CentOS6安装参考

https://about.gitlab.com/installation/#centos-6?version=ce

安装(这里使用HTTPS)

# yum install -y curl policycoreutils-python openssh-server openssh-clients cronie lokkit
# lokkit -s http -s ssh
# yum install postfix
# service postfix start
# chkconfig postfix on
# curl -sS https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh | bash
# EXTERNAL_URL="https://gitlab.example.com" yum install -y gitlab-ce

使用外部Nginx、配置Email

# vim /etc/gitlab/gitlab.rb
------------------------------------
external_url 'https://gitlab.example.com'

nginx['enable'] = false

gitlab_rails['gitlab_email_enabled'] = true
gitlab_rails['gitlab_email_from'] = 'gitlab-notify@xxx.com'
gitlab_rails['gitlab_email_display_name'] = 'Gitlab Notify'
gitlab_rails['gitlab_email_reply_to'] = 'noreply@xxx.com'
gitlab_rails['gitlab_email_subject_suffix'] = ''

gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.exmail.qq.com"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "gitlab-notify@xxx.com"
gitlab_rails['smtp_password'] = "******"
gitlab_rails['smtp_domain'] = "smtp.qq.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = true

Nginx配置（/etc/nginx/conf.d/gitlab.conf）

# 参考 https://www.liaohuqiu.net/cn/posts/non-bundled-web-server-for-gitlab/
upstream gitlab {
  # see: /var/opt/gitlab/nginx/conf/gitlab-http.conf
  server unix:/var/opt/gitlab/gitlab-workhorse/socket;
}

server {
  listen 80;
  server_name gitlab.example.com;
  rewrite ^(.*) https://$server_name$1 permanent;
}
server {
  listen 443;
  server_name gitlab.example.com;

  ssl on;
  ssl_certificate   cert/gitlab.example.com.pem;
  ssl_certificate_key  cert/gitlab.example.com.key;
  ssl_session_timeout 5m;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:XXXX;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;

  server_tokens off;     # don't show the version number, a security best practice
  root /opt/gitlab/embedded/service/gitlab-rails/public;
  # Increase this if you want to upload large attachments
  # Or if you want to accept large git objects over http
  client_max_body_size 250m;

  # individual nginx logs for this gitlab vhost
  access_log  /var/log/gitlab/nginx/gitlab_access.log;
  error_log   /var/log/gitlab/nginx/gitlab_error.log;

  location / {
    # serve static files from defined root folder;.
    # @gitlab is a named location for the upstream fallback, see below
    try_files $uri $uri/index.html $uri.html @gitlab;
  }

  # if a file, which is not found in the root folder is requested,
  # then the proxy pass the request to the upsteam (gitlab unicorn)
  location @gitlab {
    # If you use https make sure you disable gzip compression 
    # to be safe against BREACH attack

    proxy_read_timeout 300; # Some requests take more than 30 seconds.
    proxy_connect_timeout 300; # Some requests take more than 30 seconds.
    proxy_redirect     off;

    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_set_header   Host              $http_host;
    proxy_set_header   X-Real-IP         $remote_addr;
    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header   X-Frame-Options   SAMEORIGIN;

    proxy_pass http://gitlab;
  }
  # Enable gzip compression as per rails guide: http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
  # WARNING: If you are using relative urls do remove the block below
  # See config/application.rb under "Relative url support" for the list of
  # other files that need to be changed for relative url support
  location ~ ^/(assets)/  {
    root /opt/gitlab/embedded/service/gitlab-rails/public;
    # gzip_static on; # to serve pre-gzipped version
    expires max;
    add_header Cache-Control public;
  }

  error_page 502 /502.html;

权限修改，解决502问题（在gitlab-ctl reconfigure和gitlab-ctl restart之后）

chmod -R o+x /var/opt/gitlab/gitlab-rails
chmod -R o+x /var/opt/gitlab/gitlab-workhorse/

Git clone走HTTPS时免输入密码：

git config --global credential.helper store

注意项：

1. 防火墙iptables要开启22, 80, 443，465端口
2. 如果使用的是阿里云ECS，则安全组配置也要同1开启这几个端口