Git HTTP 403 error via external reverse proxy

How to Use GitLab
1

I just recently install the latest GitLab Omnibus (v10.7.2-ee) and setup it up with an external URL as http://myserver/gitlab. I had a separate Nginx server set up as reverse proxy with the following configuration:

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

    server_name myserver;

    location / {
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass $scheme://192.168.1.4;
    }

    location ~/gitlab(.*)$ {
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass $scheme://192.168.1.3/gitlab$1;
    }
}

I was able to access GitLab via browser with that URL, but I can’t git clone/pull/push to any repository via that URL. I am getting a HTTP 403 error message when accessing http://myserver/gitlab/test.git/info/refs?service=git-receive-pack:
The command you’re trying to execute is not allowed.

I didn’t have any problem doing so when running locally via http://192.168.1.3/gitlab/test.git and got no HTTP error message when accessing http://192.168.1.3/gitlab/test.git/info/refs?service=git-receive-pack.

I don’t know if this is relevant or not, but I did packet sniffing on my git client end and got two HTTP 401 error messages before getting a OK message back on the third query using the local URL. I got a HTTP 403 error on the third query using the remote URL.

2

I was able to pin down the issue. It was coming from the configuration on Nginx server. Below is the final solution.

location ^~ /gitlab {
    proxy_set_header HOST $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass $scheme://192.168.1.3;
}