gitlab 5.65 KB
Newer Older
Ben Bodenmiller's avatar
Ben Bodenmiller committed
1 2 3 4 5 6
## GitLab
##
## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters that can be uncommented.
##
##################################
7 8 9 10 11 12 13
##        CONTRIBUTING          ##
##################################
##
## If you change this file in a Merge Request, please also create
## a Merge Request on https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests
##
##################################
Ben Bodenmiller's avatar
Ben Bodenmiller committed
14 15 16 17 18 19 20 21 22 23
##        CHUNKED TRANSFER      ##
##################################
##
## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0]
## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object
## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get
## around this by tweaking this configuration file and either:
## - installing an old version of Nginx with the chunkin module [2] compiled in, or
## - using a newer version of Nginx.
##
24
## At the time of writing we do not know if either of these theoretical solutions works.
Ben Bodenmiller's avatar
Ben Bodenmiller committed
25 26 27 28 29 30 31 32 33 34
## As a workaround users can use Git over SSH to push large files.
##
## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
## [1] https://github.com/agentzh/chunkin-nginx-module#status
## [2] https://github.com/agentzh/chunkin-nginx-module
##
###################################
##         configuration         ##
###################################
##
35
## See installation.md#using-https for additional HTTPS configuration details.
36

37
upstream gitlab {
38
  server unix:/home/git/gitlab/tmp/sockets/gitlab.socket fail_timeout=0;
39 40
}

41 42 43 44 45
## Experimental: gitlab-git-http-server
# upstream gitlab-git-http-server {
#   server localhost:8181;
# }

Ben Bodenmiller's avatar
Ben Bodenmiller committed
46
## Normal HTTP host
47
server {
Luke Ashe-Browne's avatar
Luke Ashe-Browne committed
48
  ## Either remove "default_server" from the listen line below, 
49 50 51
  ## or delete the /etc/nginx/sites-enabled/default file. This will cause gitlab
  ## to be served if you visit any address that your server responds to, eg.
  ## the ip address of the server (http://x.x.x.x/)n 0.0.0.0:80 default_server;
52 53
  listen 0.0.0.0:80 default_server;
  listen [::]:80 default_server;
54 55
  server_name YOUR_SERVER_FQDN; ## Replace this with something like gitlab.example.com
  server_tokens off; ## Don't show the nginx version number, a security best practice
56
  root /home/git/gitlab/public;
Ben Bodenmiller's avatar
Ben Bodenmiller committed
57 58 59

  ## Increase this if you want to upload large attachments
  ## Or if you want to accept large git objects over http
60
  client_max_body_size 20m;
61

62 63
  ## See app/controllers/application_controller.rb for headers set

Ben Bodenmiller's avatar
Ben Bodenmiller committed
64
  ## Individual nginx logs for this GitLab vhost
65 66 67 68
  access_log  /var/log/nginx/gitlab_access.log;
  error_log   /var/log/nginx/gitlab_error.log;

  location / {
Ben Bodenmiller's avatar
Ben Bodenmiller committed
69 70
    ## Serve static files from defined root folder.
    ## @gitlab is a named location for the upstream fallback, see below.
71 72 73
    try_files $uri $uri/index.html $uri.html @gitlab;
  }

74 75
  ## We route uploads through GitLab to prevent XSS and enforce access control.
  location /uploads/ {
76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91
    ## If you use HTTPS make sure you disable gzip compression
    ## to be safe against BREACH attack.
    # gzip off;

    ## https://github.com/gitlabhq/gitlabhq/issues/694
    ## Some requests take more than 30 seconds.
    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Frame-Options     SAMEORIGIN;

92 93 94
    proxy_pass http://gitlab;
  }

Ben Bodenmiller's avatar
Ben Bodenmiller committed
95 96
  ## If a file, which is not found in the root folder is requested,
  ## then the proxy passes the request to the upsteam (gitlab unicorn).
97
  location @gitlab {
98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
    ## If you use HTTPS make sure you disable gzip compression
    ## to be safe against BREACH attack.
    # gzip off;

    ## https://github.com/gitlabhq/gitlabhq/issues/694
    ## Some requests take more than 30 seconds.
    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Frame-Options     SAMEORIGIN;

114 115
    proxy_pass http://gitlab;
  }
Jacob Vosmaer's avatar
Jacob Vosmaer committed
116

117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136
  ## Experimental: send Git HTTP traffic to gitlab-git-http-server instead of Unicorn
  # location ~ [-\/\w\.]+\.git\/ {
  #   ## If you use HTTPS make sure you disable gzip compression
  #   ## to be safe against BREACH attack.
  #   # gzip off;

  #   ## https://github.com/gitlabhq/gitlabhq/issues/694
  #   ## Some requests take more than 30 seconds.
  #   proxy_read_timeout      300;
  #   proxy_connect_timeout   300;
  #   proxy_redirect          off;

  #   proxy_set_header    Host                $http_host;
  #   proxy_set_header    X-Real-IP           $remote_addr;
  #   proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
  #   proxy_set_header    X-Forwarded-Proto   $scheme;

  #   proxy_pass http://gitlab-git-http-server;
  # }

Ben Bodenmiller's avatar
Ben Bodenmiller committed
137 138 139 140 141 142
  ## Enable gzip compression as per rails guide:
  ## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
  ## WARNING: If you are using relative urls remove the block below
  ## See config/application.rb under "Relative url support" for the list of
  ## other files that need to be changed for relative url support
  location ~ ^/(assets)/ {
143
    root /home/git/gitlab/public;
144 145 146 147 148
    gzip_static on; # to serve pre-gzipped version
    expires max;
    add_header Cache-Control public;
  }

Jacob Vosmaer's avatar
Jacob Vosmaer committed
149
  error_page 502 /502.html;
150
}