GitLab behind nginx reverse proxy

How to Use GitLab
1

Hello everyone,

I have problems getting GitLab to work behind an nginx reverse proxy.

nginx version: nginx/1.14.0 (Ubuntu)

gitlab-ce                             11.3.6-ce.0

in /etc/gitlab/gitlab.rb I have set (according to documentation):

external_url 'https://gitlab.mydomain.io'
nginx['listen_port'] = 81
nginx['listen_https'] = false

I used port 81 so the reverse proxy can bind to 80 so it’s easier to get LetsEncrypt certificates. This is my virtual host for the gitlab subdomain:

upstream gitlab {
server localhost:81 fail_timeout=0;
}

server {
listen 82;
listen [::]:82;
server_name gitlab.mydomain.io;

return 301 https://$server_name$request_uri;
}

server {
listen 443 ssl;
listen [::]:443 ssl;
server_name gitlab.mydomain.io;

ssl_certificate /etc/nginx/ssl/gitlab.mydomain.io.crt;
ssl_certificate_key /etc/nginx/ssl/gitlab.mydomain.io.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

location / {
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass https://gitlab;
}
}

When I navigate to my subdomain, I get a 502 Bad Gateway with the following error in the nginx log:

[error] 6301#6301: *6 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 88.217.180.123, server: gitlab.mydomain.io, request: “GET / HTTP/1.1”, upstream: “https://127.0.0.1:81/”, host: “gitlab.mydomain.io”

I tried using different protocols with nginx but to no avail. Does anyone have an idea?