带有外部 nginx 和多功能总线的 gitlab docker 注册表

问题描述 投票：0回答：6

我已经在 docker 容器内运行了 gitlab 服务器，并在另一个 docker 容器内运行了外部 nginx 服务器，因此 gitlab nginx 服务器已停用。现在我想使用 gitlab 服务器中包含的 docker 注册表。

我尝试从管理手册中获取信息：https://docs.gitlab.com/ee/administration/container_registry.html

并使用链接文件中合适的 nginx 配置： https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/nginx/registry-ssl

在 gitlab.rb 中我添加了：

... 
registry_external_url 'url'
registry_nginx['enable'] = false
registry['enable'] = true
...

但是如果我尝试登录（docker 登录 url），我只会收到 502 Bad Gateway 错误。我还尝试了一些其他的组合配置，但总是出现相同的错误。有人能成功吗？我需要向综合文件添加更多设置，还是仍然无法将 gitlab 内部 docker 注册表与综合和外部 nginx 一起使用？

docker nginx gitlab docker-registry gitlab-omnibus
6个回答
9
投票

好的，我成功了。 

## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters that can be uncommented.
##
###################################
##         configuration         ##
###################################

upstream docker-registry {
 server <ip_of_gitlab_docker_container>:<port_of_gitlab_container>;
}

## Redirects all HTTP traffic to the HTTPS host
server {
  listen *:80;
  server_name  sub.domain.tld;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$http_host:$request_uri;
  access_log  /var/log/nginx/gitlab_registry_access.log;
  error_log   /var/log/nginx/gitlab_registry_error.log;
}


server {
  # If a different port is specified in https://gitlab.com/gitlab-org/gitlab-ce/blob/8-8-stable/config/gitlab.yml.example#L182,
  # it should be declared here as well
  listen *:443 ssl http2;
  server_name  sub.domain.tld;
  server_tokens off; ## Don't show the nginx version number, a security best practice

  client_max_body_size 0;
  chunked_transfer_encoding on;

  ## Strong SSL Security
  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
   ssl on;
   ssl_certificate /etc/letsencrypt/live/sub.domain.tld/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/sub.domain.tld/privkey.pem;

  ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache  builtin:1000  shared:SSL:10m;
  ssl_session_timeout  5m;

  access_log  /var/log/nginx/gitlab_registry_access.log;
  error_log   /var/log/nginx/gitlab_registry_error.log;


    location /
{
     # let Nginx know about our auth file
     proxy_pass http://docker-registry;
     proxy_set_header Host $host; # required for docker client's sake
     proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
 }

 location /v2/ {
     # To add basic authentication to v2 use auth_basic setting plus
     # add_header
     add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
     proxy_pass http://docker-registry;
     proxy_set_header Host $http_host; # required for docker client's sake
     proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_read_timeout 900;
 }

}

也许 Andrioshe 的 nginx 配置也可以工作，但我在尝试时做了一些更改并与其他配置混合。我认为普通 docker-regsitry 的配置文件也可以工作......将来会尝试。

但是更重要的是gitlab的综合配置。

registry_external_url 'https://sub.domain.tld'
registry['registry_http_addr'] = "<ip_of_gitlab_docker_container>:<port_of_gitlab_container>"
registry_nginx['enable'] = false
registry['enable'] = true

将“regsitry_http_addr”设置为 gitlab docker 注册表 IP 和端口而不是 localhost 非常重要。

4
投票

我也遇到了和你一样的问题，并让它与以下内容一起工作：

Nginx：

## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters that can be uncommented.
##
###################################
##         configuration         ##
###################################

## Redirects all HTTP traffic to the HTTPS host
server {
  listen *:80;
  server_name  registry.project-oc.de;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$http_host:$request_uri;
  access_log  /var/log/nginx/gitlab_registry_access.log;
  error_log   /var/log/nginx/gitlab_registry_error.log;
}

server {
  # If a different port is specified in https://gitlab.com/gitlab-org/gitlab-ce/blob/8-8-stable/config/gitlab.yml.example#L182,
  # it should be declared here as well
  listen *:443 ssl http2;
  server_name  registry.project-oc.de;
  server_tokens off; ## Don't show the nginx version number, a security best practice

  client_max_body_size 0;
  chunked_transfer_encoding on;

  ## Strong SSL Security
  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  ssl on;
  ssl_certificate /etc/letsencrypt/live/registry.project-oc.de/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/registry.project-oc.de/privkey.pem; # managed by Certbot

  ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4';
  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache  builtin:1000  shared:SSL:10m;
  ssl_session_timeout  5m;

  access_log  /var/log/gitlab/nginx/gitlab_registry_access.log;
  error_log   /var/log/gitlab/nginx/gitlab_registry_error.log;

  location / {
    proxy_set_header  Host              $http_host;   # required for docker client's sake
    proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
    proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_read_timeout                  900;

    proxy_pass          http://localhost:5000;
  }
}

gitlab.rb

registry_external_url 'https://registry.project-oc.de'
registry_nginx['listen_port'] = 5000
gitlab_rails['registry_enabled'] = true
registry_nginx['enable'] = false
registry['enable'] = true

编辑这两个文件后，您必须重新启动 nginx 和 gitlab

1
投票

上面的答案很好，但不太适合我的设置，所以我将在这里添加我的配置，这样它可能会对某人有所帮助。我正在使用 compose 运行官方 GitLab Docker 镜像，并且我已经将 Traefik v2 设置为反向代理。这些设置取自官方 GitLab Omnibus 设置。

在docker-compose.yml的gitlab.rb环境变量部分：

gitlab_rails['registry_enabled'] = true
registry['enable'] = true
registry_external_url 'https://registry.example.com'
registry_nginx['listen_port'] = 80
registry_nginx['listen_https'] = false"

然后在 docker-compose.yml 中添加以下标签：

- "traefik.http.routers.gitlab-registry.rule=Host(`registry.example.com`)"
- "traefik.http.routers.gitlab-registry.tls=true"
- "traefik.http.routers.gitlab-registry.entrypoints=websecure"
- "traefik.http.routers.gitlab-registry.service=gitlab-registry-service"
- "traefik.http.services.gitlab-registry-service.loadbalancer.server.port=80"

这些设置应该适用于注册表的相同域或单独域。运行注册表的 nginx 服务器被告知在端口 80 上通过纯 http 运行，这使得与 Traefik 集成变得非常容易。

1
投票

问题可能是注册表端口仅绑定到本地主机网络接口，这是默认设置。

将以下内容添加到gitlab.rb

registry_external_url 'https://registry.gitlab.example.com'
gitlab_rails['registry_enabled'] = true

registry['enable'] = true
registry['username'] = "registry"
registry['group'] = "registry"
registry['dir'] = "/var/opt/gitlab/registry"
registry['registry_http_addr'] = "0.0.0.0:5050"
registry['debug_addr'] = "0.0.0.0:5051"
registry['log_directory'] = "/var/log/gitlab/registry"
registry['log_level'] = "info"

registry_nginx['enable'] = false

在 docker 上绑定端口 

5050:5050

创建外部 nginx 配置以侦听从 

https://registry.gitlab.example.com
到 
http://127.0.0.1:5050

的重定向流量 
sudo tee /etc/nginx/sites-available/registry.gitlab.example.com <<EOF
server {
   listen 81;
   server_name registry.gitlab.example.com;

   server_tokens off; ## Don't show the nginx version number, a security best practice

   client_max_body_size 0;
   chunked_transfer_encoding on;

   location /
   {
      # let Nginx know about our auth file
      proxy_pass http://127.0.0.1:5050;
      proxy_set_header Host $host; # required for docker client's sake
      proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
   }
}
EOF

使用 Let's Encrypt certbot 或任何其他提供商生成证书 

sudo certbot --nginx -d registry.gitlab.example.com

您现在应该可以访问注册表了。

0
投票

从 docker 更新 Gitlab 后，我遇到了同样的问题。

只需添加：

即可修复 
gitlab_rails['registry_enabled'] = true
registry_nginx['enable'] = false
registry['enable'] = true
0
投票

我也遇到了同样的问题，如果你运行时启用了内部 gitlab nginx（我认为这是最好的设置），你需要告诉内部 nginx 请求是安全发出的，因为你的反向代理和 nginx 之间的连接内在的人是不安全的。 为了保证这一点的安全，非常重要的是，您的前端代理中只允许 https 连接！否则，无论 gitlab cr

怎样，所有连接都将被视为 https

我的 当前配置如下：

    registry_external_url 'https://cr.example.com' #replace with your external url
    registry['enable'] = true #enables the registry
    gitlab_rails['registry_enabled'] = true #enables it as well, not suer why both but I think it is needed
    
    registry_nginx['enable'] = true #we enable the internal nginx of gitlab
    registry_nginx['listen_port'] = 5050 #we set it to listen on port 5050
    registry_nginx['listen_https'] = false #we disable it from listening https
    registry_nginx['proxy_set_headers'] = {
        "X-Forwarded-Proto" => "https", #we tell nginx that the original protocol used was https
        "X-Forwarded-Ssl" => "on" #we tell nginx that we forwarded ssl
    }

wei 的原始答案https://forum.gitlab.com/t/container-registry-behind-reverse-proxy/6848/2

我认为你可以做类似的事情：

      registry_nginx['listen_port'] = 5000 
      registry_nginx['listen_https'] = false
      registry_nginx['proxy_set_headers'] = {
        "X-Forwarded-Proto" => "https",
        "X-Forwarded-Ssl" => "on"
      }

这是我在实例中使用的。

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.