Docker Compose安装Gitlab并使用外置Nginx，启用https

mkdir gitlab
cd gitlab

touch docker-compose.yml

version: '3.6'
services:
  gitlab-ce:
    hostname: gitlab.example.com
    ports:
      - '9080:9080'
      - '9081:22'
    container_name: gitlab
    restart: always
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        # 改为自己的域名
        external_url 'https://gitlab.example.com'
        # 不使用gitlab自带的nginx
        nginx['enable'] = false
        # 设置非捆绑 Web 服务器用户的用户名
        web_server['external_users'] = ['root', 'nginx', 'www-data']
        # 将非捆绑的 Web 服务器添加到受信任代理列表中，我自己的nginx服务器ip地址
        gitlab_rails['trusted_proxies'] = ['nginx服务器ip地址']
        # 监听自定义端口，监听的端口要和暴露的端口要一致
        gitlab_workhorse['listen_network'] = "tcp"
        gitlab_workhorse['listen_addr'] = "0.0.0.0:9080"
        # 减少gitlab使用内存
        gitlab_rails['rack_attack_git_basic_auth'] = {
          'enabled' => true,
          'ip_whitelist' => ["127.0.0.1"],
          'maxretry' => 10,
          'findtime' => 60,
          'bantime' => 3600
        }
        gitlab_rails['env'] = {
          'GITLAB_RAILS_RACK_TIMEOUT' => 300
        }
        puma['worker_processes'] = 2
        puma['min_threads'] = 1
        puma['max_threads'] = 8
        puma['per_worker_max_memory_mb'] = 1200
        sidekiq['concurrency'] = 9
        postgresql['shared_buffers'] = "512MB"
        postgresql['max_worker_processes'] = 8
        # 邮箱配置，我用的阿里云企业邮箱
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "smtp.qiye.aliyun.com"
        gitlab_rails['smtp_port'] = 465
        gitlab_rails['smtp_user_name'] = "gitlab@example.com"
        gitlab_rails['smtp_password'] = "邮箱密码"
        gitlab_rails['smtp_domain'] = "gitlab.example.com"
        gitlab_rails['smtp_authentication'] = "login"
        gitlab_rails['smtp_enable_starttls_auto'] = false
        gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
        gitlab_rails['smtp_tls'] = true
        gitlab_rails['gitlab_email_from'] = "gitlab@example.com"
        gitlab_rails['gitlab_email_reply_to'] = "gitlab@example.com"
        user["git_user_email"] = "gitlab@example.com"
    volumes:
      - './config:/etc/gitlab'
      - './logs:/var/log/gitlab'
      - './data:/var/opt/gitlab'
    privileged: true
    image: gitlab/gitlab-ce

docker-compose up -d

docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password

server {
  listen *:80;
  server_name  gitlab.example.com;
  server_tokens off; ### Don't show the nginx version number, a security best practice
  return 301 https://$http_host$request_uri;
  access_log  /var/log/nginx/gitlab_registry_access.log;
  error_log   /var/log/nginx/gitlab_registry_error.log;
}

server {
  # If a different port is specified in https://gitlab.com/gitlab-org/gitlab-foss/blob/8-8-stable/config/gitlab.yml.example#L182,
  # it should be declared here as well
  listen *:443 ssl;
  server_name  gitlab.example.com;
  server_tokens off; ### Don't show the nginx version number, a security best practice

  client_max_body_size 0;
  chunked_transfer_encoding on;

  ### Strong SSL Security
  ### https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  ssl_certificate /etc/nginx/cert/cert-j76op8xez670x42z/fullchain.cer;
  ssl_certificate_key /etc/nginx/cert/cert-j76op8xez670x42z/cert.key;

  ssl_session_timeout 1d;
  #ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # These settings are in line with the modern settings from https://ssl-config.mozilla.org/
  # and are supported by all still-supported browsers since 2019. If you have specific needs
  # for older settings, please consult the intermediate settings there.
  ssl_protocols TLSv1.3;
  ssl_prefer_server_ciphers off;

  ### [Optional] Enable HTTP Strict Transport Security
  # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";

  access_log  /var/log/nginx/gitlab_registry_access.log;
  error_log   /var/log/nginx/gitlab_registry_error.log;

  location / {
    proxy_pass          http://ip:9080;
    client_max_body_size 1024m;
    proxy_set_header  Host              $http_host;   # required for docker client's sake
    proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
    proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_read_timeout                  900;
    # 为 Websocket 连接添加以下行
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }
}
stream {
    upstream gitlab_ssh {
        hash   $remote_addr consistent;
        server ip:9081;
    }
    server {
        listen 9081;
        proxy_connect_timeout   30s;
        proxy_timeout   300s;
        proxy_pass gitlab_ssh;
    }
}

docker compose down
docker compose pull
docker compose up -d

# 进入容器
docker exec -it gitlab /bin/bash
# 备份命令，备份文件默认存储在容器内的 /var/opt/gitlab/backups 目录中
gitlab-backup create
# 备份配置文件和密钥文件（可选），备份 /etc/gitlab 目录下的配置文件，备份文件默认存储在容器内的 /etc/gitlab/config_backup 目录中
gitlab-ctl backup-etc

# 编辑 GitLab 配置文件 /etc/gitlab/gitlab.rb
gitlab_rails['backup_keep_time'] = 604800  # 7 天
# 应用配置
gitlab-ctl reconfigure

chmod +x ./backup.sh

sudo crontab -e

0 2 * * * /bin/bash /root/gitlab/backup.sh CRON=1

crontab -l

unicorn['worker_timeout'] has been deprecated since 13.10 and was removed in 14.0. Starting with GitLab 14.0, Unicorn is no longer supported and users must switch to Puma, following https://docs.gitlab.com/ee/administration/operations/puma.html.