Refine nginx config for ssl connections. Implements #67 and #92

Author: axilleas

web-server/nginx/gitlab-ssl

@@ -1,36 +1,44 @@
 # GITLAB
-# Maintainer: @yin8086
-# App Version: 4.1
+# Contributors: yin8086, sashkab, orkoden, axilleas
+# App Version: 5.4 - 6.0
 
 # Modified from nginx http version
 # Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
 
-# You need from run openssl to generate the ssl certificate.
-# $ sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
-# $ sudo chmod o-r gitlab.key
+# You need to run openssl to generate a self-signed ssl certificate.
+# cd /etc/nginx/
+# sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
+# sudo chmod o-r gitlab.key
 
 upstream gitlab {
-  server unix:/home/gitlab/gitlab/tmp/sockets/gitlab.socket;
+  
+  ## Uncomment if you have set up puma/unicorn to listen on a unix socket (recommended).
+  server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
+  
+  ## Uncomment if puma/unicorn are configured to listen on a tcp port.
+  ## Check the port number in /home/git/gitlab/config/{puma.rb/unicorn.rb}
+  # server 127.0.0.1:9292;
 }
 
 # This is a normal HTTP host which redirects all traffic to the HTTPS host.
+# Replace git.example.com with your FQDN.
 server {
-    listen       80;
-    server_name Domain_NAME;
+    listen *:80;
+    server_name git.example.com;
     server_tokens off;
-    root /nowhere;
-    rewrite ^ https://gitlab.stardrad.com$request_uri permanent;
+    root /nowhere; # this doesn't have to be a valid path since we are redirecting, you don't have to change it.
+    rewrite ^ https://$server_name$request_uri permanent;
 }
 server {
     listen 443;
-    server_name Domain_NAME;
+    server_name git.example.com;
     server_tokens off;
-    root /home/gitlab/gitlab/public;
+    root /home/git/gitlab/public;
 
     ssl on;
-    ssl_certificate gitlab.crt;
-    ssl_certificate_key gitlab.key;
-    ssl_protocols  SSLv3 TLSv1 TLSv2;
+    ssl_certificate /etc/nginx/gitlab.crt;
+    ssl_certificate_key /etc/nginx/gitlab.key;
+    ssl_protocols  SSLv3 TLSv1 TLSv1.2;
     ssl_ciphers AES:HIGH:!ADH:!MD5;
     ssl_prefer_server_ciphers   on;
 
@@ -47,15 +55,15 @@ server {
     # if a file, which is not found in the root folder is requested,
     # then the proxy pass the request to the upsteam (gitlab unicorn)
     location @gitlab {
-        proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
+        proxy_read_timeout    300; # https://github.com/gitlabhq/gitlabhq/issues/694
         proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
-        proxy_redirect     off;
+        proxy_redirect        off;
 
-        proxy_set_header   X-Forwarded-Proto https;
-        proxy_set_header X-Forwarded-Ssl on;
-        proxy_set_header   Host              $http_host;
-        proxy_set_header   X-Real-IP         $remote_addr;
+        proxy_set_header  X-Forwarded-Proto https;
+        proxy_set_header  X-Forwarded-Ssl   on;
+        proxy_set_header  Host              $http_host;
+        proxy_set_header  X-Real-IP         $remote_addr;
 
         proxy_pass http://gitlab;
     }
-}
+}