Omnibus Gitlab CentOS 7 Use Let's encrypt configure free SSL

First install omnibus Gitlab, refer to

https://about.gitlab.com/downloads/

Refer to the following two articles in conjunction with configuration:

https://certbot.eff.org/#centosrhel7-nginx

https://webnugget.de/setting-up-gitlab-with-free-ssl-certs-from-lets-encrypt-on-ubuntu-14-04/

1. Install the Certbot.

$ sudo yum install epel-release$ sudo yum install Certbot

2. Configure Gitlab:

$ vi/etc/gitab/gitlab.rb

Change the following configuration items:

external_url "http://gityu.com/"nginx[‘redirect_http_to_https‘] = truenginx[‘ssl_certificate‘]= "/etc/letsencrypt/live/gityu.com/fullchain.pem"nginx[‘ssl_certificate_key‘] = "/etc/letsencrypt/live/gityu.com/privkey.pem"  

nginx[‘custom_gitlab_server_config‘]="location ^~ /.well-known {\n alias /var/www/letsencrypt/.well-known;\n}\n"  

Restart Gitlab:

$ gitlab-ctl reconfigure

3. Generate the Certificate:

$ Certbot certonly

Follow the steps to configure such as:

Using the Webroot plugin, fill in the domain name: gityu.com,

Root path:/var/www/letsencrypt

最后成功安装，有效期90天。

4. Effective https://:

$ vi/etc/gitlab/gitlab.rb

Change:

external_url "https://gityu.com/"

 

Restart the Gitlab to take effect:

$ gitlab-ctl Reconfigure

 

此时可以访问gityu.com会自动重定向到https://gityu.com，并且证书为绿色：

5. Create the crontab job to automatically update the certificate.

$ vi/etc/cron.monthly/renew-ssl-certificates

Fill in the following content:

This is updated once a month, or you can use CRONTAB-E to create a crontab job.

Note that the following command is used before using this command to verify that the update is successful:

$ Certbot Renew--dry-run

If the command fails, you can use the methods in the following article as an alternative:

https://webnugget.de/setting-up-gitlab-with-free-ssl-certs-from-lets-encrypt-on-ubuntu-14-04/

Even if the script is automatically updated:

#!/bin/bash/bin/letsencrypt certonly -c /root/letsencrypt-config/gitlab.ini --renew-by-defaultgitlab-ctl restart

Omnibus Gitlab CentOS 7 Use Let's encrypt configure free SSL