☰

如何配置 GitLab NixOS 服务的主机名？

tag-icon • tag-icon configuration ruby-on-rails gitlab nixos
如何配置 GitLab NixOS 服务的主机名？

我正在尝试在 NixOS 20.09.1632.a6a3a368dda（Nightingale）上部署一个新的 GitLab 实例。

我有这个相当最小的配置.nix：

{ modulesPath, ... }:
let
  host = "example.org";
  adminEmail = "[email protected]";
in
{
  imports = [ "${modulesPath}/virtualisation/amazon-image.nix" ];
  ec2.hvm = true;

  services.gitlab = rec {
    enable = true;

    inherit host;
    port = 80;

    # You, dear sysadmin, have to make these files exist.
    initialRootPasswordFile = "/tmp/gitlab-secrets/initial-password";

    secrets = rec {
      # A file containing 30 "0" characters.
      secretFile = "/tmp/gitlab-secrets/zeros";
      dbFile = secretFile;
      otpFile = secretFile;
      # openssl genrsa 2048 > jws.rsa
      jwsFile = "/tmp/gitlab-secrets/jws.rsa";
    };
  };

  services.nginx = {
    enable = true;
    user = "gitlab";
    virtualHosts = {
      "${host}" = {
        locations."/" = {
          # http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass
          proxyPass = "http://unix:/var/gitlab/state/tmp/sockets/gitlab.socket";
        };
      };
    };
  };

  networking.firewall = {
    enable = true;
    allowPing = false;
    allowedTCPPorts = [
      22
      80
    ];
  };
}

激活此配置时，将启动许多进程（redis、postgresql、sidekiq 等）。但是，nginx（我想这要归功于 GitLab 的 Rails HTTP 服务器）会/这样响应请求：

* Connected to example.org (X.X.X.X) port 80 (#0)
> GET / HTTP/1.1
> Host: example.org
> User-Agent: curl/7.72.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Server: nginx
< Date: Thu, 11 Feb 2021 19:38:40 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< Referrer-Policy: strict-origin-when-cross-origin
< X-UA-Compatible: IE=edge
< Location: http://localhost/users/sign_in
< Cache-Control: no-cache
< Set-Cookie: experimentation_subject_id=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklqZGhabU0zWXpVNExUSmxNR1F0TkdZMlpTMWlZVEkwTFdKak1EVTFaREZoTURJd1ppST0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5leHBlcmltZW50YXRpb25fc3ViamVjdF9pZCJ9fQ%3D%3D--cbf53392028ed41f7c582a64e643476a5c2aab6b; path=/; expires=Mon, 11 Feb 2041 19:38:40 -0000; HttpOnly
< X-Request-Id: 545cc04e-1689-4351-b5a9-ca171f1a85d4
< X-Runtime: 0.060596
< 
* Connection #0 to host example.org left intact
<html><body>You are being <a href="http://localhost/users/sign_in">redirected</a>.</body></html>

由于localhost不是example.org，所以失败。

如何配置 GitLab 以了解其自己的主机名？

答案1

所需的行为可以通过proxy_set_header NGINX 指令：

proxy_set_header Host       $host;

如果在反向代理配置中包含此行，NGINX 将localhost使用原始请求中的主机名（即）重写从上游服务器（即 GitLab）发送回来的主机头（即example.org）。在 NixOS 中启用该services.nginx.recommendedProxySettings选项将生成 NGINX 配置，其中包含指令包括。

相关内容