主页 / server / 问题 / 1053319
Accepted
Jean-Paul Calderone
Asked: 2021-02-12 11:41:15 +0800 CST

如何为 GitLab NixOS 服务配置主机名？

  • 772

我正在尝试在 NixOS 20.09.1632.a6a3a368dda (Nightingale) 上部署一个新的 GitLab 实例。

我有这个相当小的configuration.nix：

{ modulesPath, ... }:
let
  host = "example.org";
  adminEmail = "[email protected]";
in
{
  imports = [ "${modulesPath}/virtualisation/amazon-image.nix" ];
  ec2.hvm = true;

  services.gitlab = rec {
    enable = true;

    inherit host;
    port = 80;

    # You, dear sysadmin, have to make these files exist.
    initialRootPasswordFile = "/tmp/gitlab-secrets/initial-password";

    secrets = rec {
      # A file containing 30 "0" characters.
      secretFile = "/tmp/gitlab-secrets/zeros";
      dbFile = secretFile;
      otpFile = secretFile;
      # openssl genrsa 2048 > jws.rsa
      jwsFile = "/tmp/gitlab-secrets/jws.rsa";
    };
  };

  services.nginx = {
    enable = true;
    user = "gitlab";
    virtualHosts = {
      "${host}" = {
        locations."/" = {
          # http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass
          proxyPass = "http://unix:/var/gitlab/state/tmp/sockets/gitlab.socket";
        };
      };
    };
  };

  networking.firewall = {
    enable = true;
    allowPing = false;
    allowedTCPPorts = [
      22
      80
    ];
  };
}

激活此配置时，会启动许多进程（redis、postgresql、sidekiq 等）。然而，nginx（感谢，我假设，GitLab 的 Rails HTTP 服务器）用以下方式响应请求/：

* Connected to example.org (X.X.X.X) port 80 (#0)
> GET / HTTP/1.1
> Host: example.org
> User-Agent: curl/7.72.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Server: nginx
< Date: Thu, 11 Feb 2021 19:38:40 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< Referrer-Policy: strict-origin-when-cross-origin
< X-UA-Compatible: IE=edge
< Location: http://localhost/users/sign_in
< Cache-Control: no-cache
< Set-Cookie: experimentation_subject_id=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklqZGhabU0zWXpVNExUSmxNR1F0TkdZMlpTMWlZVEkwTFdKak1EVTFaREZoTURJd1ppST0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5leHBlcmltZW50YXRpb25fc3ViamVjdF9pZCJ9fQ%3D%3D--cbf53392028ed41f7c582a64e643476a5c2aab6b; path=/; expires=Mon, 11 Feb 2041 19:38:40 -0000; HttpOnly
< X-Request-Id: 545cc04e-1689-4351-b5a9-ca171f1a85d4
< X-Runtime: 0.060596
< 
* Connection #0 to host example.org left intact
<html><body>You are being <a href="http://localhost/users/sign_in">redirected</a>.</body></html>

由于localhostis not example.org，因此失败。

如何配置 GitLab 以了解其自己的主机名？

ruby-on-rails configuration gitlab nixos

1 个回答

  1. Best Answer

    proxy_set_header 使用NGINX 指令可以实现所需的行为：

    proxy_set_header Host       $host;

    如果您在反向代理配置中包含此行，NGINX 将localhost使用原始请求中的主机名（即）重写从上游服务器（即 GitLab）发回的主机头（即example.org）。services.nginx.recommendedProxySettings在 NixOS 中启用该选项将生成包含该指令的 NGINX 配置。

    • 1

相关问题