Funktionierende Gitlab-Konfiguration mit Unicorn und Apache Proxy

Problem:

Du möchtest Gitlab mit Apache und Unicorn (ohne Passenger!) einrichten, aber es funktioniert einfach nicht, egal wie sehr du dich anstrengst.

Lösung

Du bist nicht allein mit deinem Problem. Auch wenn es zahlreiche gute Tutorials im Internet gibt, hat keines bei mir funktioniert.

Mein finales Setup umfasst einen gemeinsamen Benutzer für gitolite (gitolite3 scheint notwendig zu sein, installiert in /var/lib/gitolite unter dem Benutzer gitolite) und einen Klon des stabilen gitlabhq in /opt/gitlabhq. Ich nehme an, dass du bereits den inoffiziellen und offiziellen Anleitungen gefolgt bist und die Datenbank sowie gitolite ordnungsgemäß eingerichtet sind.

Es gibt zahlreiche verschiedene Möglichkeiten, gitlabhq einzurichten, einschließlich solcher mit mod_passenger. Ich vermute, sie sind speichereffizienter als andere, aber ich konnte es nicht zum Laufen bringen.

Hier ist mein /etc/init.d/gitlab:

gitlab_init.sh

#! /bin/bash
### BEGIN INIT INFO
# Provides: gitlab
# Required-Start: $local_fs $remote_fs $network $syslog redis-server
# Required-Stop: $local_fs $remote_fs $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: GitLab git repository management
# Description: GitLab git repository management
### END INIT INFO

DAEMON_OPTS="-c /opt/gitlabhq/config/unicorn.rb -E production -D"
NAME=unicorn
DESC="Gitlab-Dienst"
PID=/opt/gitlabhq/tmp/pids/unicorn.pid
RESQUE_PID=/opt/gitlabhq/tmp/pids/resque_worker.pid

case "$1" in
start)
CD_TO_APP_DIR="cd /opt/gitlabhq"
START_DAEMON_PROCESS="bundle exec unicorn_rails $DAEMON_OPTS"
START_RESQUE_PROCESS="./resque.sh"

echo -n "Starte $DESC: "
if [ `whoami` = root ]; then
sudo -u gitolite sh -l -c "$CD_TO_APP_DIR > /dev/null 2>&1 && $START_DAEMON_PROCESS && $START_RESQUE_PROCESS"
else
$CD_TO_APP_DIR > /dev/null 2>&1 && $START_DAEMON_PROCESS && $START_RESQUE_PROCESS
fi
echo "$NAME."
;;
stop)
echo -n "Stoppe $DESC: "
kill -QUIT `cat $PID`
kill -QUIT `cat $RESQUE_PID`
echo "$NAME."
;;
restart)
echo -n "Starte $DESC neu: "
kill -USR2 `cat $PID`
kill -USR2 `cat $RESQUE_PID`
echo "$NAME."
;;
reload)
echo -n "Lade $DESC-Konfiguration neu: "
kill -HUP `cat $PID`
kill -HUP `cat $RESQUE_PID`
echo "$NAME."
;;
*)
echo "Verwendung: $NAME {start|stop|restart|reload}" >&2
exit 1
;;
esac
exit 0

#! /bin/bash
### BEGIN INIT INFO
# Provides: gitlab
# Required-Start: $local_fs $remote_fs $network $syslog redis-server
# Required-Stop: $local_fs $remote_fs $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: GitLab git repository management
# Description: GitLab git repository management
### END INIT INFO

DAEMON_OPTS="-c /opt/gitlabhq/config/unicorn.rb -E production -D"
NAME=unicorn
DESC="Gitlab-Dienst"
PID=/opt/gitlabhq/tmp/pids/unicorn.pid
RESQUE_PID=/opt/gitlabhq/tmp/pids/resque_worker.pid

case "$1" in
start)
CD_TO_APP_DIR="cd /opt/gitlabhq"
START_DAEMON_PROCESS="bundle exec unicorn_rails $DAEMON_OPTS"
START_RESQUE_PROCESS="./resque.sh"

echo -n "Starte $DESC: "
if [ `whoami` = root ]; then
sudo -u gitolite sh -l -c "$CD_TO_APP_DIR > /dev/null 2>&1 && $START_DAEMON_PROCESS && $START_RESQUE_PROCESS"
else
$CD_TO_APP_DIR > /dev/null 2>&1 && $START_DAEMON_PROCESS && $START_RESQUE_PROCESS
fi
echo "$NAME."
;;
stop)
echo -n "Stoppe $DESC: "
kill -QUIT `cat $PID`
kill -QUIT `cat $RESQUE_PID`
echo "$NAME."
;;
restart)
echo -n "Starte $DESC neu: "
kill -USR2 `cat $PID`
kill -USR2 `cat $RESQUE_PID`
echo "$NAME."
;;
reload)
echo -n "Lade $DESC-Konfiguration neu: "
kill -HUP `cat $PID`
kill -HUP `cat $RESQUE_PID`
echo "$NAME."
;;
*)
echo "Verwendung: $NAME {start|stop|restart|reload}" >&2
exit 1
;;
esac
exit 0

Hier ist meine .gitolite.rc

gitolite_rc.pl

# Konfigurationsvariablen für gitolite

# Diese Datei verwendet Perl-Syntax. Aber man muss KEIN Perl können, um sie zu bearbeiten --
# einfach auf die Kommas achten, einfache Anführungszeichen verwenden, solange man nicht weiß, was man tut,
# und sicherstellen, dass Klammern und geschweifte Klammern übereinstimmen!

# (Tipp: Perl erlaubt ein Komma nach dem letzten Element in einer Liste!)

# Hilfe für Befehle (siehe COMMANDS-Liste unten) erhält man, indem man den
# Befehl mit "-h" als einzigem Argument ausführt.

# Hilfe für alle anderen externen Programme (die syntactic-sugar-Helfer und
# die verschiedenen Programme/Funktionen in den 8 Trigger-Listen) findet sich in
# doc/non-core.mkd (http://sitaramc.github.com/gitolite/non-core.html) oder in
# der entsprechenden Quelldatei selbst.

%RC = (
    # if you're using mirroring, you need a hostname.  This is *one* simple
    # word, not a full domain name.  See documentation if in doubt
    # HOSTNAME                  =>  'darkstar',
    UMASK                       =>  0007,

    # look in the "GIT-CONFIG" section in the README for what to do
    GIT_CONFIG_KEYS             =>  '.*',

    # comment out if you don't need all the extra detail in the logfile
    LOG_EXTRA                   =>  1,

    # settings used by external programs; uncomment and change as needed.  You
    # can add your own variables for use in your own external programs; take a
    # look at the info and desc commands for perl and shell samples.

    # used by the CpuTime trigger
    # DISPLAY_CPU_TIME          =>  1,
    # CPU_TIME_WARN_LIMIT       =>  0.1,
    # used by the desc command
    # WRITER_CAN_UPDATE_DESC    =>  1,
    # used by the info command
    # SITE_INFO                 =>  'Please see http://blahblah/gitolite for more help',

    # add more roles (like MANAGER, TESTER, ...) here.
    #   WARNING: if you make changes to this hash, you MUST run 'gitolite
    #   compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'
    ROLES                       =>
        {
            READERS             =>  1,
            WRITERS             =>  1,
        },
    # uncomment (and change) this if you wish
    # DEFAULT_ROLE_PERMS          =>  'READERS @all',

    # comment out or uncomment as needed
    # these are available to remote users
    COMMANDS                    =>
        {
            'help'              =>  1,
            'desc'              =>  1,
            # 'fork'            =>  1,
            'info'              =>  1,
            # 'mirror'          =>  1,
            'perms'             =>  1,
            # 'sskm'            =>  1,
            'writable'          =>  1,
            # 'D'               =>  1,
        },

    # comment out or uncomment as needed
    # these will run in sequence during the conf file parse
    SYNTACTIC_SUGAR             =>
        [
            # 'continuation-lines',
            # 'keysubdirs-as-groups',
        ],

    # comment out or uncomment as needed
    # these will run in sequence to modify the input (arguments and environment)
    INPUT                       =>
        [
            # 'CpuTime::input',
            # 'Shell::input',
            # 'Alias::input',
            # 'Mirroring::input',
        ],

    # comment out or uncomment as needed
    # these will run in sequence just after the first access check is done
    ACCESS_1                    =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence just before the actual git command is invoked
    PRE_GIT                     =>
        [
            # 'renice 10',
            # 'Mirroring::pre_git',
            # 'partial-copy',
        ],

    # comment out or uncomment as needed
    # these will run in sequence just after the second access check is done
    ACCESS_2                    =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence after the git command returns
    POST_GIT                    =>
        [
            # 'Mirroring::post_git',
            # 'CpuTime::post_git',
        ],

    # comment out or uncomment as needed
    # these will run in sequence before a new wild repo is created
    PRE_CREATE                  =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence after a new repo is created
    POST_CREATE                 =>
        [
            'post-compile/update-git-configs',
            'post-compile/update-gitweb-access-list',
            'post-compile/update-git-daemon-access-list',
        ],

    # comment out or uncomment as needed
    # these will run in sequence after post-update
    POST_COMPILE                =>
        [
            'post-compile/ssh-authkeys',
            'post-compile/update-git-configs',
            'post-compile/update-gitweb-access-list',
            'post-compile/update-git-daemon-access-list',
        ],
);

# ------------------------------------------------------------------------------
# per perl rules, this should be the last line in such a file:
1;

# Local variables:
# mode: perl
# End:
# vim: set syn=perl:

# Konfigurationsvariablen für gitolite

# Diese Datei verwendet Perl-Syntax. Aber man muss KEIN Perl können, um sie zu bearbeiten --
# einfach auf die Kommas achten, einfache Anführungszeichen verwenden, solange man nicht weiß, was man tut,
# und sicherstellen, dass Klammern und geschweifte Klammern übereinstimmen!

# (Tipp: Perl erlaubt ein Komma nach dem letzten Element in einer Liste!)

# Hilfe für Befehle (siehe COMMANDS-Liste unten) erhält man, indem man den
# Befehl mit "-h" als einzigem Argument ausführt.

# Hilfe für alle anderen externen Programme (die syntactic-sugar-Helfer und
# die verschiedenen Programme/Funktionen in den 8 Trigger-Listen) findet sich in
# doc/non-core.mkd (http://sitaramc.github.com/gitolite/non-core.html) oder in
# der entsprechenden Quelldatei selbst.

%RC = (
    # if you're using mirroring, you need a hostname.  This is *one* simple
    # word, not a full domain name.  See documentation if in doubt
    # HOSTNAME                  =>  'darkstar',
    UMASK                       =>  0007,

    # look in the "GIT-CONFIG" section in the README for what to do
    GIT_CONFIG_KEYS             =>  '.*',

    # comment out if you don't need all the extra detail in the logfile
    LOG_EXTRA                   =>  1,

    # settings used by external programs; uncomment and change as needed.  You
    # can add your own variables for use in your own external programs; take a
    # look at the info and desc commands for perl and shell samples.

    # used by the CpuTime trigger
    # DISPLAY_CPU_TIME          =>  1,
    # CPU_TIME_WARN_LIMIT       =>  0.1,
    # used by the desc command
    # WRITER_CAN_UPDATE_DESC    =>  1,
    # used by the info command
    # SITE_INFO                 =>  'Please see http://blahblah/gitolite for more help',

    # add more roles (like MANAGER, TESTER, ...) here.
    #   WARNING: if you make changes to this hash, you MUST run 'gitolite
    #   compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'
    ROLES                       =>
        {
            READERS             =>  1,
            WRITERS             =>  1,
        },
    # uncomment (and change) this if you wish
    # DEFAULT_ROLE_PERMS          =>  'READERS @all',

    # comment out or uncomment as needed
    # these are available to remote users
    COMMANDS                    =>
        {
            'help'              =>  1,
            'desc'              =>  1,
            # 'fork'            =>  1,
            'info'              =>  1,
            # 'mirror'          =>  1,
            'perms'             =>  1,
            # 'sskm'            =>  1,
            'writable'          =>  1,
            # 'D'               =>  1,
        },

    # comment out or uncomment as needed
    # these will run in sequence during the conf file parse
    SYNTACTIC_SUGAR             =>
        [
            # 'continuation-lines',
            # 'keysubdirs-as-groups',
        ],

    # comment out or uncomment as needed
    # these will run in sequence to modify the input (arguments and environment)
    INPUT                       =>
        [
            # 'CpuTime::input',
            # 'Shell::input',
            # 'Alias::input',
            # 'Mirroring::input',
        ],

    # comment out or uncomment as needed
    # these will run in sequence just after the first access check is done
    ACCESS_1                    =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence just before the actual git command is invoked
    PRE_GIT                     =>
        [
            # 'renice 10',
            # 'Mirroring::pre_git',
            # 'partial-copy',
        ],

    # comment out or uncomment as needed
    # these will run in sequence just after the second access check is done
    ACCESS_2                    =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence after the git command returns
    POST_GIT                    =>
        [
            # 'Mirroring::post_git',
            # 'CpuTime::post_git',
        ],

    # comment out or uncomment as needed
    # these will run in sequence before a new wild repo is created
    PRE_CREATE                  =>
        [
        ],

    # comment out or uncomment as needed
    # these will run in sequence after a new repo is created
    POST_CREATE                 =>
        [
            'post-compile/update-git-configs',
            'post-compile/update-gitweb-access-list',
            'post-compile/update-git-daemon-access-list',
        ],

    # comment out or uncomment as needed
    # these will run in sequence after post-update
    POST_COMPILE                =>
        [
            'post-compile/ssh-authkeys',
            'post-compile/update-git-configs',
            'post-compile/update-gitweb-access-list',
            'post-compile/update-git-daemon-access-list',
        ],
);

# ------------------------------------------------------------------------------
# per perl rules, this should be the last line in such a file:
1;

# Local variables:
# mode: perl
# End:
# vim: set syn=perl:

Dies ist meine gitlab.yml

gitlab.yml

# # # # # # # # # # # # # # # # # #
# Gitlab-Anwendungskonfigurationsdatei  #
# # # # # # # # # # # # # # # # # #

#
# 1. Allgemeine Einstellungen
# ==========================

# Webanwendungsspezifische Einstellungen
web:
  host: localhost
  port: 80
  https: false

# E-Mail für Benachrichtigungen
# über neue Issues, Kommentare
email:
  from: [email protected]
  to: btronik.de
  protocol: https

# Anwendungsspezifische Einstellungen
# Wie z.B. Standard-Projektlimit für Benutzer etc
app:
  default_projects_limit: 10
  # backup_path: "/vol/backups"   # default: Rails.root + backups/
  # backup_keep_time: 604800      # default: 0 (forever) (in seconds)
  # disable_gravatar: true        # default: false - Disable user avatars from Gravatar.com

#
# 2. Authentifizierungs-Einstellungen
# ==========================
ldap:
  enabled: false
  host: '_your_ldap_server'
  base: '_the_base_where_you_search_for_users'
  port: 636
  uid: 'sAMAccountName'
  method: 'ssl' # plain
  bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
  password: '_the_password_of_the_bind_user'

omniauth:
  # Benutzern ermöglichen
  # sich via Twitter, Google anzumelden ..
  enabled: false

  # WICHTIG!
  # Erlaubt Benutzern die Anmeldung ohne Benutzerkonto
  allow_single_sign_on: false
  block_auto_created_users: true

  # Auth-Anbieter
  providers:
    # - { name: 'google_oauth2', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET',
    #     args: { access_type: 'offline', approval_prompt: '' } }
    # - { name: 'twitter', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET'}
    # - { name: 'github', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET' }

#
# 3. Erweiterte Einstellungen:
# ==========================

# Git-Hosting-Konfiguration
git_host:
  admin_uri: [email protected]:gitolite-admin
  base_path: /var/lib/gitolite/repositories/
  hooks_path: /var/lib/gitolite/.gitolite/hooks/
  gitolite_admin_key: gitlab
  git_user: gitolite
  upload_pack: true
  receive_pack: true
  host: btronik.de
  # config_file: gitolite.conf
  # port: 22

# Git-Einstellungen
# Standardwerte verwenden, sofern man sie nicht versteht
git:
  path: /usr/bin/git
  # Maximale Größe von Git-Objekten wie Commits, in Bytes
  # Dieser Wert kann erhöht werden, wenn man sehr große Commits hat
  git_max_size: 5242880 # 5.megabytes
  # Git-Timeout zum Lesen von Commits, in Sekunden
  git_timeout: 10

# # # # # # # # # # # # # # # # # #
# Gitlab-Anwendungskonfigurationsdatei  #
# # # # # # # # # # # # # # # # # #

#
# 1. Allgemeine Einstellungen
# ==========================

# Webanwendungsspezifische Einstellungen
web:
  host: localhost
  port: 80
  https: false

# E-Mail für Benachrichtigungen
# über neue Issues, Kommentare
email:
  from: gitlab@btronik.de
  to: btronik.de
  protocol: https

# Anwendungsspezifische Einstellungen
# Wie z.B. Standard-Projektlimit für Benutzer etc
app:
  default_projects_limit: 10
  # backup_path: "/vol/backups"   # default: Rails.root + backups/
  # backup_keep_time: 604800      # default: 0 (forever) (in seconds)
  # disable_gravatar: true        # default: false - Disable user avatars from Gravatar.com

#
# 2. Authentifizierungs-Einstellungen
# ==========================
ldap:
  enabled: false
  host: '_your_ldap_server'
  base: '_the_base_where_you_search_for_users'
  port: 636
  uid: 'sAMAccountName'
  method: 'ssl' # plain
  bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
  password: '_the_password_of_the_bind_user'

omniauth:
  # Benutzern ermöglichen
  # sich via Twitter, Google anzumelden ..
  enabled: false

  # WICHTIG!
  # Erlaubt Benutzern die Anmeldung ohne Benutzerkonto
  allow_single_sign_on: false
  block_auto_created_users: true

  # Auth-Anbieter
  providers:
    # - { name: 'google_oauth2', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET',
    #     args: { access_type: 'offline', approval_prompt: '' } }
    # - { name: 'twitter', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET'}
    # - { name: 'github', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET' }

#
# 3. Erweiterte Einstellungen:
# ==========================

# Git-Hosting-Konfiguration
git_host:
  admin_uri: gitolite@btronik.de:gitolite-admin
  base_path: /var/lib/gitolite/repositories/
  hooks_path: /var/lib/gitolite/.gitolite/hooks/
  gitolite_admin_key: gitlab
  git_user: gitolite
  upload_pack: true
  receive_pack: true
  host: btronik.de
  # config_file: gitolite.conf
  # port: 22

# Git-Einstellungen
# Standardwerte verwenden, sofern man sie nicht versteht
git:
  path: /usr/bin/git
  # Maximale Größe von Git-Objekten wie Commits, in Bytes
  # Dieser Wert kann erhöht werden, wenn man sehr große Commits hat
  git_max_size: 5242880 # 5.megabytes
  # Git-Timeout zum Lesen von Commits, in Sekunden
  git_timeout: 10

Und schließlich meine Apache2 Virtual Host-Konfiguration. Beachte, dass ich Gitlab auf Port 3001 konfiguriere, um Port 8080 für andere Anwendungen freizuhalten:

gitlab_apache_vhost.conf

<VirtualHost *:80>
    ServerName gitlab.mydomain.de
    #Nicht zu HTTPS weiterleiten
    ErrorLog /var/log/apache2/owncloud_error.log
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>
<VirtualHost *:443>
  ServerName gitlab.mydomain.de
  DocumentRoot /opt/gitlabhq/public
  ErrorLog /var/log/apache2/gitlab-error.log
  CustomLog /var/log/apache2/gitlab-access.log combined

  SSLEngine on
  SSLCertificateFile /etc/apache2/ssl.crt/btronik-wildcardcert.pem
  SSLCertificateKeyFile /etc/apache2/ssl.crt/btronik-wildcardkey.pem
  SSLCACertificateFile /etc/apache2/ssl.crt/ca.pem

      # Folgendes erlaubt „schöne“ URLs wie https://etherpad.example.org/padname
            ProxyVia On
            ProxyRequests Off
            ProxyPass / http://127.0.0.1:3001/
            ProxyPassReverse / http://127.0.0.1:3001/
            ProxyPreserveHost on
            <Proxy *>
                Options FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
            </Proxy>

</VirtualHost>

<VirtualHost *:80>
    ServerName gitlab.mydomain.de
    #Nicht zu HTTPS weiterleiten
    ErrorLog /var/log/apache2/owncloud_error.log
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>
<VirtualHost *:443>
  ServerName gitlab.mydomain.de
  DocumentRoot /opt/gitlabhq/public
  ErrorLog /var/log/apache2/gitlab-error.log
  CustomLog /var/log/apache2/gitlab-access.log combined

  SSLEngine on
  SSLCertificateFile /etc/apache2/ssl.crt/btronik-wildcardcert.pem
  SSLCertificateKeyFile /etc/apache2/ssl.crt/btronik-wildcardkey.pem
  SSLCACertificateFile /etc/apache2/ssl.crt/ca.pem

      # Folgendes erlaubt „schöne“ URLs wie https://etherpad.example.org/padname
            ProxyVia On
            ProxyRequests Off
            ProxyPass / http://127.0.0.1:3001/
            ProxyPassReverse / http://127.0.0.1:3001/
            ProxyPreserveHost on
            <Proxy *>
                Options FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
            </Proxy>

</VirtualHost>

Check out similar posts by category: Allgemein

If this post helped you, please consider buying me a coffee or donating via PayPal to support research & publishing of new posts on TechOverflow

Buy me a coffee