[WIP] Substitute rewrite with proxypass.
Merge request reports
Activity
@mosmani please see question on description and review.
@balameb here is the complete vhost, you dont need a location definition:
### set in gitlab.rb # nginx #external_url 'https://gitlab.example.com' #nginx['enable'] = false # # workhorse #gitlab_workhorse['listen_network'] = "tcp" #gitlab_workhorse['listen_addr'] = "127.0.0.1:8181" #web_server['external_users'] = ['www-data'] # # rails app #gitlab_rails['internal_api_url'] = 'https://gitlab.example.com' #gitlab_rails['time_zone'] = 'Europe/Berlin' <VirtualHost *:80> ServerName gitlab.example.com Redirect permanent "/" "https://gitlab.example.com/" </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> ServerName gitlab.example.com ProxyRequests Off SSLProxyEngine On ProxyPreserveHost On AllowEncodedSlashes NoDecode ProxyPass / http://127.0.0.1:8181/ keepalive=On connectiontimeout=10 retry=0 ProxyPassReverse / http://127.0.0.1:8181/ RequestHeader set X_FORWARDED_PROTO 'https' RequestHeader set X-Forwarded-Ssl on SSLEngine on SSLCertificateFile /etc/apache2/ssl.crt/gitlab.example.com.crt SSLCertificateKeyFile /etc/apache2/ssl.key/gitlab.example.com.key ErrorLog ${APACHE_LOG_DIR}/gitlab.example.com-error.log CustomLog ${APACHE_LOG_DIR}/gitlab.example.com-access.log combined </VirtualHost> </IfModule>
Edited by username-removed-938690@mosmani right but what about other options such as
SSLProtocol all -SSLv2
or theErrorDocument
options? Don't we want to include those as well?When you start using mod_proxy with "/" then every other directive concerning conent (ErrorDocument) is useless because every request will be routed through the proxy to the backend.
From my point of view every person who calls him "admin" should care about the SSL/TLS Security of his server in general and not only for one vhost thats why i didnt insert all SSL/TLS options in my generic vhost suggestion.