How to separate two URL after domain name?

itkroplis · June 20, 2018, 8:38am

Hi!
I have the Ubuntu server with docker+ docker registry (https://git-registry.local.com/v2/_catalog
I install GitLab-ee server to this server (It is currently working on a port 80). But I want it to answer the URL https://git-gitlab.local.com
How it is possible? Need used GitLab-Nginx for other URL! Or maybe need install individual Nginx!
Nginx reverse proxy can split every source URL to own dns name? And what is the example!?

By default after installing, GitLab nginx is enabled?

nightman68 · June 20, 2018, 7:48pm

Hi,

try this post as a base: https://www.reddit.com/r/gitlab/comments/5zd329/container_registry_behind_reverse_proxy/

Just add one server{} entry for gitlab and another one for the registry both with the acc. redirects in gitlab.rb.

itkroplis · June 21, 2018, 9:22pm

I trying:
gitlab port 80 (127.0.0.1:8080)
registry:2 port 5000

nginx reverse proxy as virtual host. Two differents dns name (wildcard cert) and published:

server {
listen 443;
server_name gitlab.local.com;

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

server {
listen 443;
server_name registry.local.com;

location / {
    proxy_pass http://127.0.0.1:5000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

This work. I see both site as https. But registry is a problem for remote images push to registry. I didn’t find how registry:2 allow remote access with HTTP

I resolv it. I configure all remote docker hosts for insecure-registries:

cat > /etc/docker/daemon.json

{
“insecure-registries” : [“hostanme.ip:5000”]
}

and add in nginx.conf sub http

#set client body size to *M #
client_max_body_size 1024M;

nightman68 · June 22, 2018, 5:46pm

Well done. I assume that you’re using your own CA for the certificates?! Have a look here. Place the CA cert in the described directory and you don’t need the insecure setting. For me it works without the port included in the directory name.

The client_max_body_size if 1G is probably a bit small when you try to push larger images…

Good luck!

itkroplis · June 22, 2018, 8:54pm

I use godady wildcard certificate. If you advice I’ll bet, I thought CA not required. I’ll test this method on Monday. Snx.

itkroplis · June 29, 2018, 10:53am

After switching to NGINX (as virtual host) began problem

To write (push) images can well but pull is an error (Kubernetes cluster)

Q.

In /etc/default/docker this is correctly?

DOCKER_OPTS=’–insecure-registry 10.94.10.128:5000’
DOCKER_OPTS=’–insecure-registry 10.94.10.128:443’
DOCKER_OPTS=’–insecure-registry registry.local:443’

In /etc/docker/daemon.json this is correctly?

{
“insecure-registries” : [“10.94.10.128:5000”]
“insecure-registries” : [“10.94.10.128:443”]
“insecure-registries” : [“registry.local:443”]
}

In:
/etc/docker/certs.d/10.94.10.128:443/ca.crt
/etc/docker/certs.d/registry.local:443/ca.crt
this is correctly if ca.crt contain 3 certificats?

two godady chain and my certificate
this is correctly?

nightman68 · June 29, 2018, 7:31pm

What OS you’re using? Some OS probably using different path - refer to the docker link I provided earlier. Provide the logs when you discover error during the pull operation.

What release of GitLab you’re using, there were some changes with the certificates handling?
The configuration you mentioned under point 1 and 2 is not necessary I would say. I do not use them and push and pull works fine.
To what you mentioned in point 3 the following:

I’m using only the CA certificate nothing else. Including the entire chain should work.
Using IP adresses in certificates is probably not the best choice, use a CNAME!
I don’t know godady - just try to access a URL with such a certificate with Chrome or Firefox. When the browser worrying about the authentizity it is not part of the system certificate key chain and not accepted by any tool.

It’s not such an easy think to configure the SSL configuration. I spend a lot of time. Use Google when you have error messages during access.

Good luck

itkroplis · June 29, 2018, 8:00pm

I use Ubuntu (16.04 UP) and Debian (8 UP) OS. This server is a Ubuntu 17.
I use GitLab-ee latest

After 1) 2) 3) configured to all remote docker and Kubernetes hosts. Deploy (pull/push) happened well. Which method helped I don’t know. Most likely ca.crt, because I don’t restart any dockers daemon.