Gitlab是一個用Ruby on Rails開發的開源專案管理程式.可以通過WEB介面進行訪問公開的或者私人項目. 它和Github有類似的功能，能夠瀏覽原始碼，管理缺陷和注釋.
本文選擇NGINX與MYSQL來配合GitLab實現web管理,資料存放區等功能,配置過程中痛點基本在GitLab的指令碼修改,SSH秘鑰串連,Nginx SSL認證等這些方面,作者也是耗費非常大的力氣,結合很多文檔的clue以及很多老外的debug comment,終於最終完成,希望在此給大家一個拋磚引玉的機會,瞭解到SCM(軟體組態管理)其實也不是想象中那麼小兒科,很多邏輯也著實需要下功夫investigation.
最後我是一路向北,我為我自己帶鹽....
解決方案：
環境部署
作業系統 centos6.3 x64
GitLab GitLab 6-3-stable
GitLab Shell 1.8.0
Ruby 2.0.0p353
NGINX nginx-1.4.0
MYSQL mysql-5.6.10
Git server(centos6.3 x64): git.example.com
Git client(centos6.3 x64): client.example.com
server端配置:
一.安裝前的準備工作
1.關閉iptables和SELINUX
# service iptables stop
# setenforce 0
# vi /etc/sysconfig/selinux
---------------
SELINUX=disabled
---------------
2.同步時間
# ntpdate cn.pool.ntp.org
3.安裝LNMP
傳送門：http://www.showerlee.com/archives/73
4.安裝GitLab的所需依賴包和工具
# su -
# rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-5-4.noarch.rpm
# yum -y groupinstall 'Development Tools'
# yum -y install vim-enhanced readline readline-devel ncurses-devel gdbm-devel glibc-devel tcl-devel openssl-devel curl-devel expat-devel db4-devel byacc sqlite-devel gcc-c++ libyaml libyaml-devel libffi libffi-devel libxml2 libxml2-devel libxslt libxslt-devel libicu libicu-devel system-config-firewall-tui python-devel redis sudo wget crontabs logwatch logrotate perl-Time-HiRes git
5.配置redis
配置redis開機啟動：
# chkconfig redis on
# service redis start
6.更改gem源(若預設無法串連)
a.顯示當前使用的sources
# gem sources
b.刪除預設source
# gem sources -r http://rubygems.org/
c.添加一個source
# gem sources -a http://ruby.taobao.org
d.更新source cache
# gem sources -u
6.安裝Ruby
a.源碼安裝Ruby
傳送門: http://www.showerlee.com/archives/1123
b.安裝bundle組件：
# gem install bundler --no-ri --no-rdoc
二.安裝GITLab shell
1.建立使用者git
# su -
# adduser --system --shell /bin/bash --comment 'GitLab' --create-home --home-dir /home/git/ git
2、配置GitLab shell
GitLab shell是專門為GitLab開發的提供ssh訪問和版本管理的軟體。
a.使用git賬戶登陸
# su - git
b.複製gitlab shell
# git clone https://github.com/gitlabhq/gitlab-shell.git
c.切換成1.8.0版本，並編輯配置
# cd gitlab-shell
# git checkout v1.8.0
d.拷貝設定檔
# cp config.yml.example config.yml
# vi config.yml
—————————————————————————————————————————
# 將gitlab_url修改成gitlab的訪問網域名稱。例如本文檔：https://git.example.com/
gitlab_url: "https://git.example.com"
# 將self_signed_cert修改成 true
self_signed_cert: true
# 添加網站SSL認證
ca_file: "/usr/local/nginx/ssl/gitlab.crt"
—————————————————————————————————————————
註：如果gitlab是使用http訪問，則需將https替換成http，設定檔中的self_signed_cert要修改成false，否則gitlab shell在通過api和gitlab進行通訊的時候就會出現錯誤，導致項目push出錯。因為後面配置web伺服器的時候是使用ssl，所以這裡要按照ssl的方式配置。
另外本文檔的網域名稱為測試網域名稱，不要忘記在C/S兩端均做好網域名稱映射。
e.安裝一些需要的目錄和檔案
# ./bin/install
5、配置MySQL資料庫(安裝過程詳見上文)
a.登入資料庫
# mysql -u root -p
b. 為gitlab建立使用使用者
> create user gitlab@'localhost' identified by '123456';
c.建立gitlaba使用的資料庫
> CREATE DATABASE IF NOT EXISTS `gitlabhq_production` DEFAULT CHARACTER SET `utf8` COLLATE `utf8_unicode_ci`;
d.給予gitlab使用者權限
> GRANT SELECT, LOCK TABLES, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON `gitlabhq_production`.* TO 'gitlab'@'localhost';
三.安裝GitLab
1.將GitLab安裝在git的家目錄下：
# su - git
2.複製GitLab並切換分支到6-3-stable
a.複製GitLab
# git clone https://github.com/gitlabhq/gitlabhq.git gitlab
b. 切換到6-3-stable分支
# cd /home/git/gitlab
# git checkout 6-3-stable
c、設定項目
a.複製設定檔
# cp config/gitlab.yml.example config/gitlab.yml
b.修改設定檔中的訪問網域名稱
# sed -i 's|localhost|git.example.com|g' config/gitlab.yml
d.設定log和tmp目錄所有者和許可權
# chown -R git log/
# chown -R git tmp/
# chmod -R u+rwX log/
# chmod -R u+rwX tmp/
e.建立gitlab-satellites目錄
# mkdir /home/git/gitlab-satellites
f.建立tmp/pids/和tmp/sockets/目錄，確保gitlab有相應的許可權
# mkdir tmp/pids/
# mkdir tmp/sockets/
# chmod -R u+rwX tmp/pids/
# chmod -R u+rwX tmp/sockets/
g.建立public/uploads目錄
# mkdir public/uploads
# chmod -R u+rwX public/uploads
h.複製unicorn配置
# cp config/unicorn.rb.example config/unicorn.rb
i.保持unicorn設定檔預設配置
g.配置git的使用者和郵件
# git config --global user.name "GitLab"
# git config --global user.email "gitlab@git.example.com”
# git config --global core.autocrlf input
k.設定資料庫訪問檔案
# cp config/database.yml.mysql config/database.yml
編輯config/database.yml，設定其中串連資料庫的帳號密碼
# vi config/database.yml
———————————————————————————————————
#
# PRODUCTION
#
production:
adapter: mysql2
encoding: utf8
reconnect: false
database: gitlabhq_production
pool: 10
username: gitlab
password: “123456”
# host: localhost
# socket: /tmp/mysql.sock
———————————————————————————————————
修改其中username和password就可以了，其中密碼就是上面資料庫步驟中建立gitlab使用者的密碼。
l.確保該檔案只有git帳號有許可權讀取。
# chmod o-rwx config/database.yml
四.安裝Gems
1.安裝charlock_holmes
# su -
# gem install charlock_holmes --version '0.6.9.4'
# exit
2.安裝mysql包
# cd /home/git/gitlab/
# vi Gemfile
修改 https://rubygems.org 為 http://ruby.taobao.org
# bundle install --deployment --without development test postgres puma aws
若報Could not find modernizr-2.6.2 in any of the sources錯誤,沒有則無視:
修複方案:
# vi Gemfile
搜尋該行 gem "modernizr", "2.6.2"
更改為： gem "modernizr-rails", "2.7.1"
# vi Gemfile.lock
搜尋該行 modernizr (2.6.2)
更改為： modernizr-rails (2.7.1)
搜尋該行 modernizr (= 2.6.2)：
更改為： modernizr-rails (= 2.7.1)
重新執行
# bundle install --deployment --without development test postgres puma aws
3.初始化資料和啟用進階功能
# cd /home/git/gitlab
# bundle exec rake gitlab:setup RAILS_ENV=production
這步完成後，會生一個預設的管理員帳號/密碼：
admin@local.host/5iveL!fe
4.安裝啟動指令碼
# su -
# wget -O /etc/init.d/gitlab https://raw.github.com/gitlabhq/gitlab-recipes/5-0-stable/init.d/gitlab
# chmod +x /etc/init.d/gitlab
5.開機時啟動
# chkconfig --add gitlab
# chkconfig gitlab on
6.檢測應用程式狀態
# su - git
# cd gitlab/
# bundle exec rake gitlab:env:info RAILS_ENV=production
# exit
可以查看到系統、Ruby、GitLab和GitLab Shell的版本和其他資訊。
7.啟動GitLab執行個體
# service gitlab start
8.查看應用更加詳細的資訊
# su - git
# cd gitlab/
# bundle exec rake gitlab:check RAILS_ENV=production
這裡會提示一個Init script up-to-date的錯誤，如下：
——————————————————————————————————————————————————
Init script up-to-date? ... no
Try fixing it:
Redownload the init script
For more information see:
doc/install/installation.md in section "Install Init Script"
Please fix the error above and rerun the checks.
——————————————————————————————————————————————————
查閱官方內建文檔,說明此問題可忽略.
五.Nginx配置
1.配置Gitlab虛擬機器主機及SSL串連:
# cd /usr/local/nginx/conf/vhosts/
# vi gitlab-ssl.conf
注: 這裡先感謝提供此指令碼的極客,該指令碼在原基礎上稍作改動.
內容用紅字標註的地方為需要自訂的地方.
————————————————————————————————————————————
## GitLab
## Contributors: randx, yin8086, sashkab, orkoden, axilleas
## App Version: 5.4 - 6.0
##
## Modified from nginx http version
## Modified from http://blog.phusion.nl/2012/04/21/tutorial-setting-up-gitlab-on-debian-6/
##
## Lines starting with two hashes (##) are comments containing information
## for configuration. One hash (#) comments are actual configuration parameters
## which you can comment/uncomment to your liking.
##
###################################
## SSL configuration ##
###################################
##
## Optimal configuration is taken from:
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
## Make sure to read it and understand what each option does.
##
## [Optional] Generate a self-signed ssl certificate:
## mkdir /etc/nginx/ssl/
## cd /etc/nginx/ssl/
## sudo openssl req -newkey rsa:2048 -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
## sudo chmod o-r gitlab.key
##
## Edit `gitlab-shell/config.yml`:
## 1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
## 2) Set "ca_file" to `/etc/nginx/ssl/gitlab.crt`
## 3) Set "self_signed_cert" to `true`
## Edit `gitlab/config/gitlab.yml`:
## 1) Define port for http "port: 443"
## 2) Enable https "https: true"
## 3) Update ssl for gravatar "ssl_url: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm"
##
##################################
## CHUNKED TRANSFER ##
##################################
##
## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0]
## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object
## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get
## around this by tweaking this configuration file and either:
## - installing an old version of Nginx with the chunkin module [2] compiled in, or
## - using a newer version of Nginx.
##
## At the time of writing we do not know if either of these theoretical solutions works. As a workaround
## users can use Git over SSH to push large files.
##
## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
## [1] https://github.com/agentzh/chunkin-nginx-module#status
## [2] https://github.com/agentzh/chunkin-nginx-module
upstream gitlab {
## Uncomment if you have set up puma/unicorn to listen on a unix socket (recommended).
server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
## Uncomment if puma/unicorn are configured to listen on a tcp port.
## Check the port number in /home/git/gitlab/config/{puma.rb/unicorn.rb}
# server 127.0.0.1:8080;
}
## This is a normal HTTP host which redirects all traffic to the HTTPS host.
server {
listen *:80;
## Replace git.example.com with your FQDN.
server_name git.example.com;
server_tokens off;
## This doesn't have to be a valid path since we are redirecting,
## you don't have to change it.
root /nowhere;
rewrite ^ https://$server_name$request_uri permanent;
}
server {
listen 443 ssl;
## Replace git.example.com with your FQDN.
server_name git.example.com;
server_tokens off;
root /home/git/gitlab/public;
## Increase this if you want to upload large attachments
## Or if you want to accept large git objects over http
client_max_body_size 20m;
## Strong SSL Security
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl on;
ssl_certificate /usr/local/nginx/ssl/gitlab.crt;
ssl_certificate_key /usr/local/nginx/ssl/gitlab.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache builtin:1000 shared:SSL:10m;
#add_header Strict-Transport-Security max-age=63072000;
#add_header X-Frame-Options DENY;
#add_header X-Content-Type-Options nosniff;
## Individual nginx logs for this GitLab vhost
access_log /usr/local/nginx/logs/gitlab_access.log;
error_log /usr/local/nginx/logs/gitlab_error.log;
location / {
## Serve static files from defined root folder.
## @gitlab is a named location for the upstream fallback, see below.
try_files $uri $uri/index.html $uri.html @gitlab;
}
## If a file, which is not found in the root folder is requested,
## then the proxy pass the request to the upsteam (gitlab unicorn).
location @gitlab {
## If you use https make sure you disable gzip compression
## to be safe against BREACH attack.
gzip off;
## https://github.com/gitlabhq/gitlabhq/issues/694
## Some requests take more than 30 seconds.
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080;
}
## Enable gzip compression as per rails guide:
## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
#location ~ ^/(assets)/ {
# root /home/git/gitlab/public;
# gzip_static on; # to serve pre-gzipped version
# expires max;
# add_header Cache-Control public;
#}
error_page 502 /502.html;
}
————————————————————————————————————
2.將nginx加入git使用者組(重要)
# usermod -a -G git nginx
# chmod g+rx /home/git/
3.產生ssl認證
# mkdir /usr/local/nginx/ssl
# cd /usr/local/nginx/ssl
# openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
4.啟動nginx
# service nginx start
5.開啟web頁面 git.example.com
nginx直接跳轉URL為https://git.example.com
注:視瀏覽器不同這裡首先會提示認證不受信任,因為我們在此是自己給自己頒發的認證,所以非官方CA授權,有需要授權的朋友可以通過很多其他途徑購買.
