How to serve other vhosts next to Gitlab Omnibus server? [Full step-by-step solution]

Question

I installed Gitlab CE on a dedicated Ubuntu 14.04 server edition with Omnibus package.

Now I would want to install three other virtual hosts next to gitlab.

Two are node.js web applications launched by a non-root user running on two distinct ports > 1024, the third is a PHP web application that need a web server to be launched from.

There are:

• a private bower registry running on 8081 (node.js)
• a private npm registry running on 8082 (node.js)
• a private composer registry (PHP)

But Omnibus listen 80 and doesn't seem to use neither Apache2 or Nginx, thus I can't use them to serve my PHP app and reverse-proxy my two other node apps.

What serving mechanics Gitlab Omnibus uses to listen 80 ? How should I create the three other virtual hosts to be able to provide the following vHosts ?

• gitlab.mycompany.com (:80) -- already in use
• bower.mycompany.com (:80)
• npm.mycompany.com (:80)
• packagist.mycompany.com (:80)

Answer 1

About these

But Omnibus listen 80 and doesn't seem to use neither Apache2 or Nginx [, thus ...].

and @stdob comment :

Did omnibus not use nginx as a web server ??? –

Wich I responded

I guess not because nginx package isn't installed in the system ...

In facts

From Gitlab official docs :

By default, omnibus-gitlab installs GitLab with bundled Nginx.

So yes!

Omnibus package actually uses Nginx !

but it was bundled, explaining why it doesn't require to be installed as dependency from the host OS.

Thus YES! Nginx can, and should be used to serve my PHP app and reverse-proxy my two other node apps.

Then now

Omnibus-gitlab allows webserver access through user gitlab-www which resides in the group with the same name. To allow an external webserver access to GitLab, external webserver user needs to be added gitlab-www group.

To use another web server like Apache or an existing Nginx installation you will have to do the following steps:

Disable bundled Nginx by specifying in /etc/gitlab/gitlab.rb

nginx['enable'] = false
# For GitLab CI, use the following:
ci_nginx['enable'] = false

Check the username of the non-bundled web-server user. By default, omnibus-gitlab has no default setting for external webserver user. You have to specify the external webserver user username in the configuration! Let's say for example that webserver user is www-data. In /etc/gitlab/gitlab.rb set

web_server['external_users'] = ['www-data']

This setting is an array so you can specify more than one user to be added to gitlab-www group.

Run sudo gitlab-ctl reconfigure for the change to take effect.

Setting the NGINX listen address or addresses

By default NGINX will accept incoming connections on all local IPv4 addresses. You can change the list of addresses in /etc/gitlab/gitlab.rb.

nginx['listen_addresses'] = ["0.0.0.0", "[::]"] # listen on all IPv4 and IPv6 addresses

For GitLab CI, use the ci_nginx['listen_addresses'] setting.

Setting the NGINX listen port

By default NGINX will listen on the port specified in external_url or implicitly use the right port (80 for HTTP, 443 for HTTPS). If you are running GitLab behind a reverse proxy, you may want to override the listen port to something else. For example, to use port 8080:

nginx['listen_port'] = 8080

Similarly, for GitLab CI:

ci_nginx['listen_port'] = 8081

Supporting proxied SSL

By default NGINX will auto-detect whether to use SSL if external_url contains https://. If you are running GitLab behind a reverse proxy, you may wish to keep the external_url as an HTTPS address but communicate with the GitLab NGINX internally over HTTP. To do this, you can disable HTTPS using the listen_https option:

nginx['listen_https'] = false

Similarly, for GitLab CI:

ci_nginx['listen_https'] = false

Note that you may need to configure your reverse proxy to forward certain headers (e.g. Host, X-Forwarded-Ssl, X-Forwarded-For, X-Forwarded-Port) to GitLab.

You may see improper redirections or errors (e.g. "422 Unprocessable Entity", "Can't verify CSRF token authenticity") if you forget this step. For more information, see:

• What's the de facto standard for a Reverse Proxy to tell the backend SSL is used?
• https://wiki.apache.org/couchdb/Nginx_As_a_Reverse_Proxy

To go further you can follow the official docs at https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/nginx.md#using-a-non-bundled-web-server

Configuring our gitlab virtual host

Installing Phusion Passenger

We need to install ruby (gitlab run in omnibus with a bundled ruby) globally in the OS

$ sudo apt-get update 
$ sudo apt-get install ruby
$ sudo gem install passenger

Recompile nginx with the passenger module

Instead of Apache2 for example, nginx isn't able to be plugged with binary modules on-the-fly. It must be recompiled for each new plugin you want to add.

Phusion passenger developer team worked hard to provide saying, "a bundled nginx version of passenger" : nginx bins compiled with passenger plugin.

So, lets use it:

requirement: we need to open our TCP port 11371 (the APT key port).

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 561F9B9CAC40B2F7
$ sudo apt-get install apt-transport-https ca-certificates

creating passenger.list

$ sudo nano /etc/apt/sources.list.d/passenger.list

with these lignes

# Ubuntu 14.04
deb https://oss-binaries.phusionpassenger.com/apt/passenger trusty main

use the right repo for your ubuntu version. For Ubuntu 15.04 for example: deb https://oss-binaries.phusionpassenger.com/apt/passenger vivid main

Edit permissions:

$ sudo chown root: /etc/apt/sources.list.d/passenger.list
$ sudo chmod 600 /etc/apt/sources.list.d/passenger.list

Updating package list:

$ sudo apt-get update

Allowing it as unattended-upgrades

$ sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Find or create this config block on top of the file:

// Automatically upgrade packages from these (origin:archive) pairs
Unattended-Upgrade::Allowed-Origins {

  // you may have some instructions here

};

Add the following:

// Automatically upgrade packages from these (origin:archive) pairs
Unattended-Upgrade::Allowed-Origins {

  // you may have some instructions here

  // To check "Origin:" and "Suite:", you could use e.g.:
  // grep "Origin\|Suite" /var/lib/apt/lists/oss-binaries.phusionpassenger.com*
    "Phusion:stable";

};

Now (re)install nginx-extra and passenger:

$ sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak_"$(date +%Y-%m-%d_%H:%M)"
$ sudo apt-get install nginx-extras passenger

configure it

Uncomment the passenger_root and passenger_ruby directives in the /etc/nginx/nginx.conf file:

$ sudo nano /etc/nginx/nginx.conf

... to obtain something like:

##
# Phusion Passenger config
##
# Uncomment it if you installed passenger or passenger-enterprise
##

passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
passenger_ruby /usr/bin/passenger_free_ruby;

create the nginx site configuration (the virtual host conf)

$ nano /etc/nginx/sites-available/gitlab.conf

server {
  listen *:80;
  server_name gitlab.mycompany.com;
  server_tokens off;
  root /opt/gitlab/embedded/service/gitlab-rails/public;

  client_max_body_size 250m;
  access_log  /var/log/gitlab/nginx/gitlab_access.log;
  error_log   /var/log/gitlab/nginx/gitlab_error.log;

  # Ensure Passenger uses the bundled Ruby version
  passenger_ruby /opt/gitlab/embedded/bin/ruby;

  # Correct the $PATH variable to included packaged executables
  passenger_env_var PATH "/opt/gitlab/bin:/opt/gitlab/embedded/bin:/usr/local/bin:/usr/bin:/bin";

  # Make sure Passenger runs as the correct user and group to
  # prevent permission issues
  passenger_user git;
  passenger_group git;

  # Enable Passenger & keep at least one instance running at all times
  passenger_enabled on;
  passenger_min_instances 1;

  error_page 502 /502.html;
}

Now we can enable it:

$ sudo ln -s /etc/nginx/sites-available/gitlab.cong /etc/nginx/sites-enabled/

There is no a2ensite equivalent coming natively with nginx, so we use ln, but if you want, there is a project on github: nginx_ensite: nginx_ensite and nginx_dissite for quick virtual host enabling and disabling

This is a shell (Bash) script that replicates for nginx the Debian a2ensite and a2dissite for enabling and disabling sites as virtual hosts in Apache 2.2/2.4.

It' done :-). Finally, restart nginx

$ sudo service nginx restart

With this new configuration, you are able to run other virtual hosts next to gitlab to serve what you want

Just create new configs in /etc/nginx/sites-available.

In my case, I made running and serving this way on the same host :

• gitlab.mycompany.com - the awesome git platform written in ruby
• ci.mycompany.com - the gitlab continuous integration server written in ruby
• npm.mycompany.com - a private npm registry written in node.js
• bower.mycompany.com - a private bower registry written in node.js
• packagist.mycompany.com - a private packagist for composer registry written in php

For example, to serve npm.mycompany.com :

Create a directory for logs:

$ sudo mkdir -p /var/log/private-npm/nginx/

And fill a new vhost config file:

$ sudo nano /etc/nginx/sites-available/npm.conf

With this config

server {
  listen *:80;
  server_name npm.mycompany.com

  client_max_body_size 5m;
  access_log  /var/log/private-npm/nginx/npm_access.log;
  error_log   /var/log/private-npm/nginx/npm_error.log;

  location / {
    proxy_pass http://localhost:8082;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }
}

Then enable it and restart it:

$ sudo ln -s /etc/nginx/sites-available/npm.conf /etc/nginx/sites-enabled/
$ sudo service nginx restart