VCS/GitLab/Install
Aller à la navigation
Aller à la recherche
Installation de gitlab
Préparation
Installation de redis
yum install redis
service redis start
chkconfig --levels 35 redis on
Installation de git et de ruby
yum install git python-docutils ruby ruby-irb rubygems rubygem-rdoc rubygem-rake \
rubygem-psych rubygem-minitest rubygem-json rubygem-io-console rubygem-bigdecimal
Redirection des mail root
Modification du fichier /etc/aliases
sed -i -e '/^root:/ s/marc/dfabert@b2pweb.com/'
newaliases
Ajout de l'utilisateur git
Mot de passe: pai<We2ieg8o
adduser -s /bin/bash -c 'GitLab User' -d /var/lib/git -m git
passwd git
chmod 755 /var/lib/git/
Installation de mysql
yum install mysql-server
mysql_install_db
service mysqld start
chkconfig mysqld on
mysql_secure_installation
CREATE USER 'git'@'localhost' IDENTIFIED BY 'gitlabpasswd';
CREATE DATABASE IF NOT EXISTS gitlab DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;
GRANT SELECT, LOCK TABLES, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON gitlab.* TO 'git'@'localhost';
Installation
Installation de GitLab shell
su - git
cd /var/lib/git
git clone https://gitlab.com/gitlab-org/gitlab-shell.git -b v1.8.0
cd gitlab-shell
cp config.yml.example config.yml
Fichier <path>/var/lib/git/gitlab-shell/config.yml</path>
# GitLab user. git by default
user: git
# Url to gitlab instance. Used for api calls. Should end with a slash.
gitlab_url: "https://gitlab.b2pweb.com/"
http_settings:
# user: someone
# password: somepass
#ca_file: /etc/pki/httpd/httpdca.crt
#ca_path: /etc/pki/httpd
self_signed_cert: true
# Repositories path
# Give the canonicalized absolute pathname,
# REPOS_PATH MUST NOT CONTAIN ANY SYMLINK!!!
# Check twice that none of the components is a symlink, including "/home".
repos_path: "/var/lib/git/repositories/"
# File used as authorized_keys for gitlab user
auth_file: "/var/lib/git/.ssh/authorized_keys"
# Redis settings used for pushing commit notices to gitlab
redis:
bin: /usr/bin/redis-cli
host: 127.0.0.1
port: 6379
# socket: /tmp/redis.socket # Only define this if you want to use sockets
namespace: resque:gitlab
# Log file.
# Default is gitlab-shell.log in the root directory.
log_file: "/var/lib/git/gitlab-shell/gitlab-shell.log"
# Log level. INFO by default
log_level: INFO
# Audit usernames.
# Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but
# incurs an extra API call on every gitlab-shell command.
audit_usernames: false
./bin/install
Installation de Gitlab
cd /var/lib/git
git clone https://gitlab.com/gitlab-org/gitlab-ce.git -b 6-4-stable gitlab
cd gitlab
cp config/gitlab.yml.example config/gitlab.yml
<path>/var/lib/git/gitlab/config/gitlab.yml</path>
# # # # # # # # # # # # # # # # # #
# GitLab application config file #
# # # # # # # # # # # # # # # # # #
#
# How to use:
# 1. copy file as gitlab.yml
# 2. Replace gitlab -> host with your domain
# 3. Replace gitlab -> email_from
production: &base
#
# 1. GitLab app settings
# ==========================
## GitLab settings
gitlab:
## Web server settings
host: gitlab.b2pweb.com
port: 443
https: true
# Uncomment and customize the last line to run in a non-root path
# WARNING: We recommend creating a FQDN to host GitLab in a root path instead of this.
# Note that four settings need to be changed for this to work.
# 1) In your application.rb file: config.relative_url_root = "/gitlab"
# 2) In your gitlab.yml file: relative_url_root: /gitlab
# 3) In your unicorn.rb: ENV['RAILS_RELATIVE_URL_ROOT'] = "/gitlab"
# 4) In ../gitlab-shell/config.yml: gitlab_url: "http://127.0.0.1/gitlab"
# To update the path, run: sudo -u git -H bundle exec rake assets:precompile RAILS_ENV=production
#
# relative_url_root: /gitlab
# Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
# user: git
## Email settings
# Email address used in the "From" field in mails sent by GitLab
email_from: gitlab@b2pweb.com
# Email address of your support contact (default: same as email_from)
support_email: srs@b2pweb.com
## User settings
default_projects_limit: 100
# default_can_create_group: false # default: true
# username_changing_enabled: false # default: true - User can change her username/namespace
## Default theme
## BASIC = 1
## MARS = 2
## MODERN = 3
## GRAY = 4
## COLOR = 5
# default_theme: 2 # default: 2
## Users management
# default: false - Account passwords are not sent via the email if signup is enabled.
# signup_enabled: true
# Restrict setting visibility levels for non-admin users.
# The default is to allow all levels.
#restricted_visibility_levels: [ "public" ]
## Automatic issue closing
# If a commit message matches this regular expression, all issues referenced from the matched text will be closed.
# This happens when the commit is pushed or merged into the default branch of a project.
# When not specified the default issue_closing_pattern as specified below will be used.
# issue_closing_pattern: ([Cc]lose[sd]|[Ff]ixe[sd]) +#\d+
## Default project features settings
default_projects_features:
issues: true
merge_requests: true
wiki: true
wall: false
snippets: false
visibility_level: "public" # can be "private" | "internal" | "public"
## External issues trackers
issues_tracker:
# redmine:
# title: "Redmine"
# ## If not nil, link 'Issues' on project page will be replaced with this
# ## Use placeholders:
# ## :project_id - GitLab project identifier
# ## :issues_tracker_id - Project Name or Id in external issue tracker
# project_url: "http://redmine.sample/projects/:issues_tracker_id"
#
# ## If not nil, links from /#\d/ entities from commit messages will replaced with this
# ## Use placeholders:
# ## :project_id - GitLab project identifier
# ## :issues_tracker_id - Project Name or Id in external issue tracker
# ## :id - Issue id (from commit messages)
# issues_url: "http://redmine.sample/issues/:id"
#
# ## If not nil, linkis to creating new issues will be replaced with this
# ## Use placeholders:
# ## :project_id - GitLab project identifier
# ## :issues_tracker_id - Project Name or Id in external issue tracker
# new_issue_url: "http://redmine.sample/projects/:issues_tracker_id/issues/new"
#
# jira:
# title: "Atlassian Jira"
# project_url: "http://jira.sample/issues/?jql=project=:issues_tracker_id"
# issues_url: "http://jira.sample/browse/:id"
# new_issue_url: "http://jira.sample/secure/CreateIssue.jspa"
## Gravatar
gravatar:
enabled: true # Use user avatar image from Gravatar.com (default: true)
# plain_url: "http://..." # default: http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=mm
# ssl_url: "https://..." # default: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=mm
#
# 2. Auth settings
# ==========================
## LDAP settings
# You can inspect the first 100 LDAP users with login access by running:
# bundle exec rake gitlab:ldap:check[100] RAILS_ENV=production
ldap:
enabled: false
host: '_your_ldap_server'
base: '_the_base_where_you_search_for_users'
port: 636
uid: 'sAMAccountName'
method: 'ssl' # "ssl" or "plain"
bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
password: '_the_password_of_the_bind_user'
allow_username_or_email_login: true
## OmniAuth settings
omniauth:
# Allow login via Twitter, Google, etc. using OmniAuth providers
enabled: false
# CAUTION!
# This allows users to login without having a user account first (default: false).
# User accounts will be created automatically when authentication was successful.
allow_single_sign_on: false
# Locks down those users until they have been cleared by the admin (default: true).
block_auto_created_users: true
## Auth providers
# Uncomment the following lines and fill in the data of the auth provider you want to use
# If your favorite auth provider is not listed you can use others:
# see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Working-custom-omniauth-provider-configurations
# The 'app_id' and 'app_secret' parameters are always passed as the first two
# arguments, followed by optional 'args' which can be either a hash or an array.
providers:
# - { name: 'google_oauth2', app_id: 'YOUR APP ID',
# app_secret: 'YOUR APP SECRET',
# args: { access_type: 'offline', approval_prompt: '' } }
# - { name: 'twitter', app_id: 'YOUR APP ID',
# app_secret: 'YOUR APP SECRET'}
# - { name: 'github', app_id: 'YOUR APP ID',
# app_secret: 'YOUR APP SECRET' }
#
# 3. Advanced settings
# ==========================
# GitLab Satellites
satellites:
# Relative paths are relative to Rails.root (default: tmp/repo_satellites/)
path: /var/lib/git/gitlab-satellites/
## Backup settings
backup:
path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/)
# keep_time: 604800 # default: 0 (forever) (in seconds)
## GitLab Shell settings
gitlab_shell:
path: /var/lib/git/gitlab-shell/
# REPOS_PATH MUST NOT BE A SYMLINK!!!
repos_path: /var/lib/git/repositories/
hooks_path: /var/lib/git/gitlab-shell/hooks/
# Git over HTTP
upload_pack: true
receive_pack: true
# If you use non-standard ssh port you need to specify it
# ssh_port: 22
## Git settings
# CAUTION!
# Use the default values unless you really know what you are doing
git:
bin_path: /usr/bin/git
# Max size of a git object (e.g. a commit), in bytes
# This value can be increased if you have very large commits
max_size: 5242880 # 5.megabytes
# Git timeout to read a commit, in seconds
timeout: 10
#
# 4. Extra customization
# ==========================
extra:
## Google analytics. Uncomment if you want it
# google_analytics_id: '_your_tracking_id'
## Text under sign-in page (Markdown enabled)
# sign_in_text: |
# 
# [Learn more about CompanyName](http://www.companydomain.com/)
development:
<<: *base
test:
<<: *base
issues_tracker:
redmine:
title: "Redmine"
project_url: "http://redmine/projects/:issues_tracker_id"
issues_url: "http://redmine/:project_id/:issues_tracker_id/:id"
new_issue_url: "http://redmine/projects/:issues_tracker_id/issues/new"
staging:
<<: *base
Post installation
Permissions
chown -R git:git log
chown -R git:git tmp
chmod -R 775 log
chmod -R 775 tmp
Création du répertoires pour les satellites
mkdir /var/lib/git/gitlab-satellites
Création des répertoires pour les sockets/pids
mkdir tmp/pids
mkdir tmp/sockets
chmod 775 tmp/sockets
chmod 775 tmp/pids
Création du répertoires public/uploads pour les backup
mkdir public/uploads
chmod 775 public/uploads
Copie des fichiers de conf
cp config/unicorn.rb.example config/unicorn.rb
Fichier <path>/var/lib/git/gitlab/config/unicorn.rb</path>
# Sample verbose configuration file for Unicorn (not Rack)
#
# This configuration file documents many features of Unicorn
# that may not be needed for some applications. See
# http://unicorn.bogomips.org/examples/unicorn.conf.minimal.rb
# for a much simpler configuration file.
#
# See http://unicorn.bogomips.org/Unicorn/Configurator.html for complete
# documentation.
# Uncomment and customize the last line to run in a non-root path
# WARNING: We recommend creating a FQDN to host GitLab in a root path instead of this.
# Note that four settings need to be changed for this to work.
# 1) In your application.rb file: config.relative_url_root = "/gitlab"
# 2) In your gitlab.yml file: relative_url_root: /gitlab
# 3) In your unicorn.rb: ENV['RAILS_RELATIVE_URL_ROOT'] = "/gitlab"
# 4) In ../gitlab-shell/config.yml: gitlab_url: "http://127.0.0.1/gitlab"
# To update the path, run: sudo -u git -H bundle exec rake assets:precompile RAILS_ENV=production
#
# ENV['RAILS_RELATIVE_URL_ROOT'] = "/gitlab"
# Use at least one worker per core if you're on a dedicated server,
# more will usually help for _short_ waits on databases/caches.
worker_processes 2
# Since Unicorn is never exposed to outside clients, it does not need to
# run on the standard HTTP port (80), there is no reason to start Unicorn
# as root unless it's from system init scripts.
# If running the master process as root and the workers as an unprivileged
# user, do this to switch euid/egid in the workers (also chowns logs):
# user "unprivileged_user", "unprivileged_group"
# Help ensure your application will always spawn in the symlinked
# "current" directory that Capistrano sets up.
working_directory "/var/lib/git/gitlab" # available in 0.94.0+
# listen on both a Unix domain socket and a TCP port,
# we use a shorter backlog for quicker failover when busy
listen "/var/lib/git/gitlab/tmp/sockets/gitlab.socket", :backlog => 64
listen "127.0.0.1:8080", :tcp_nopush => true
# nuke workers after 30 seconds instead of 60 seconds (the default)
timeout 30
# feel free to point this anywhere accessible on the filesystem
pid "/var/lib/git/gitlab/tmp/pids/unicorn.pid"
# By default, the Unicorn logger will write to stderr.
# Additionally, some applications/frameworks log to stderr or stdout,
# so prevent them from going to /dev/null when daemonized here:
stderr_path "/var/lib/git/gitlab/log/unicorn.stderr.log"
stdout_path "/var/lib/git/gitlab/log/unicorn.stdout.log"
# combine Ruby 2.0.0dev or REE with "preload_app true" for memory savings
# http://rubyenterpriseedition.com/faq.html#adapt_apps_for_cow
preload_app true
GC.respond_to?(:copy_on_write_friendly=) and
GC.copy_on_write_friendly = true
# Enable this flag to have unicorn test client connections by writing the
# beginning of the HTTP headers before calling the application. This
# prevents calling the application for connections that have disconnected
# while queued. This is only guaranteed to detect clients on the same
# host unicorn runs on, and unlikely to detect disconnects even on a
# fast LAN.
check_client_connection false
before_fork do |server, worker|
# the following is highly recomended for Rails + "preload_app true"
# as there's no need for the master process to hold a connection
defined?(ActiveRecord::Base) and
ActiveRecord::Base.connection.disconnect!
# The following is only recommended for memory/DB-constrained
# installations. It is not needed if your system can house
# twice as many worker_processes as you have configured.
#
# This allows a new master process to incrementally
# phase out the old master process with SIGTTOU to avoid a
# thundering herd (especially in the "preload_app false" case)
# when doing a transparent upgrade. The last worker spawned
# will then kill off the old master process with a SIGQUIT.
old_pid = "#{server.config[:pid]}.oldbin"
if old_pid != server.pid
begin
sig = (worker.nr + 1) >= server.worker_processes ? :QUIT : :TTOU
Process.kill(sig, File.read(old_pid).to_i)
rescue Errno::ENOENT, Errno::ESRCH
end
end
#
# Throttle the master from forking too quickly by sleeping. Due
# to the implementation of standard Unix signal handlers, this
# helps (but does not completely) prevent identical, repeated signals
# from being lost when the receiving process is busy.
# sleep 1
end
after_fork do |server, worker|
# per-process listener ports for debugging/admin/migrations
# addr = "127.0.0.1:#{9293 + worker.nr}"
# server.listen(addr, :tries => -1, :delay => 5, :tcp_nopush => true)
# the following is *required* for Rails + "preload_app true",
defined?(ActiveRecord::Base) and
ActiveRecord::Base.establish_connection
# if preload_app is true, then you may also want to check and
# restart any other shared sockets/descriptors such as Memcached,
# and Redis. TokyoCabinet file handles are safe to reuse
# between any number of forked children (assuming your kernel
# correctly implements pread()/pwrite() system calls)
end
cp config/initializers/rack_attack.rb.example config/initializers/rack_attack.rb
Configuration globale des settings Git
git config --global user.name "GitLab"
git config --global user.email "gitlab@b2pweb.com"
git config --global core.autocrlf input
Database Setup
cp config/database.yml.mysql config/database.yml
Fichier <path>/var/lib/git/gitlab/config/database.yml</path>
#
# PRODUCTION
#
production:
adapter: mysql2
encoding: utf8
reconnect: false
database: gitlab
pool: 10
username: git
password: "gitlabpasswd"
# host: localhost
# socket: /tmp/mysql.sock
#
# Development specific
#
development:
adapter: mysql2
encoding: utf8
reconnect: false
database: gitlab_development
pool: 5
username: root
password: "secure password"
# socket: /tmp/mysql.sock
# Warning: The database defined as "test" will be erased and
# re-generated from your development database when you run "rake".
# Do not set this db to the same as development or production.
test: &test
adapter: mysql2
encoding: utf8
reconnect: false
database: gitlab_test
pool: 5
username: root
password:
# socket: /tmp/mysql.sock
En tant que root
Installation des outils de dev
yum install libxslt-devel libyaml-devel libxml2-devel gdbm-devel libffi-devel zlib zlib-devel openssl-devel libyaml-devel readline readline-devel curl-devel openssl-devel pcre-devel git memcached-devel valgrind-devel mysql-devel ImageMagick-devel ImageMagick libicu libicu-devel libffi-devel make bzip2 autoconf automake libtool bison iconv-devel ruby-devel rubygems-devel perl-ExtUtils-MakeMaker httpd mod_ssl
yum groupinstall "Development Tools"
Mise en place du logrotate
cp /var/lib/git/gitlab/lib/support/logrotate/gitlab /etc/logrotate.d/gitlab
Mise en place du script d'initializers
curl --output /etc/init.d/gitlab https://raw.github.com/gitlabhq/gitlab-recipes/5-0-stable/init.d/gitlab
chmod +x /etc/init.d/gitlab
Remplacer la valeur par défaut pour le home de git
APP_ROOT="/var/lib/git/gitlab"
Mise en place de la pki avec mon script magique: manageCA
-----------------------------------------------------------------
CA Global Options
-----------------------------------------------------------------
1) Country Name [FR]
2) State Name [P.A.C.A.]
3) City Name [Cavaillon]
4) Company Name [B2PWeb]
5) OCSP URL [http://gitlab.b2pweb.com/]
s) Save Options
p) Previous menu
==> Make your choice [none]: p
==> Select New CA name [NONE]: httpd
=====================================================================
B2PWeb Certificate Management System
=====================================================================
1) Create a Client/Server/OCSP certificate
2) Create a Client Certificate for Web (PKCS#12)
3) Renew a Certificate
4) Revoke a Certificate
5) List Certificates
i) Initialize Root Certificate Authority (CA)
r) Regenerate CRL
d) Delete CA
o) Show/Modify/Save CA Options
q) Quit
Options available before init
p) Change PKI default path [/etc/pki]
n) Change CA name [httpd]
==> Make your choice [none]: i
-----------------------------------------------------------------
httpd CA Initialisation
-----------------------------------------------------------------
==> Fully qualified Hostname [NONE]: gitlab.b2pweb.com
==> Admin email [NONE]: root@gitlab.b2pweb.com
==> Add Alternative Name [N/y]:
==> Add Alternative IP Address [N/y]:
-----------------------------------------------------------------
Hostname: gitlab.b2pweb.com
Admin email: root@gitlab.b2pweb.com
-----------------------------------------------------------------
Create certificate authority with this parameters ? [Y/n]:
Using configuration from /etc/pki/httpd/ssl.cnf
CRL regenerated.
CA initialized
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 16756927691484340495 (0xe88c90f411d4a10f)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=FR, ST=P.A.C.A., L=Cavaillon, O=B2PWeb, OU=Certificate Authority, CN=gitlab.b2pweb.com/emailAddress=root@gitlab.b2pweb.com
Validity
Not Before: Jan 17 11:09:34 2014 GMT
Not After : Jan 15 11:09:34 2024 GMT
Subject: C=FR, ST=P.A.C.A., L=Cavaillon, O=B2PWeb, OU=Certificate Authority, CN=gitlab.b2pweb.com/emailAddress=root@gitlab.b2pweb.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b8:67:5f:26:4b:45:02:de:dd:01:43:19:23:5f:
77:56:b4:5e:8c:aa:4c:17:51:66:26:31:d3:c0:f1:
f3:96:20:b9:db:4f:4c:af:f1:78:7f:7a:5a:80:09:
57:8d:03:1a:b4:d4:aa:a0:f7:94:88:7e:bd:e8:75:
79:b8:41:10:90:b7:47:3a:cb:08:e2:70:61:5e:5e:
5e:8e:f9:eb:97:2e:af:6f:76:65:18:77:18:2d:57:
2a:9a:88:6d:fa:e2:d4:c1:5d:e9:08:f4:c9:58:9b:
4e:0b:24:50:43:cb:b5:51:02:22:9f:26:94:93:e5:
11:29:0a:9d:f6:93:19:b6:d4:ff:49:e6:83:3d:ab:
3d:08:4d:36:d9:bc:c8:c1:2c:1e:27:0a:31:18:eb:
07:58:d6:52:c4:a0:91:05:6f:fc:57:0e:c8:ea:65:
18:38:49:c4:5b:38:3b:66:34:77:4c:e4:7f:65:1d:
40:1c:8d:b1:21:1e:14:d9:9f:fe:83:2f:01:fb:e3:
55:e0:60:4d:cf:22:60:ad:c6:ba:7c:56:da:75:08:
27:6b:80:b4:09:13:f7:29:3b:51:f9:cb:a3:49:93:
08:1c:e4:24:6d:6a:78:03:b1:98:f6:b2:a0:7c:1f:
af:9f:fc:7d:89:dd:ab:3c:84:1d:94:09:bd:bd:61:
00:f3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
A4:AF:6F:39:B0:6F:62:88:02:0C:21:6E:27:51:3D:97:45:B9:B7:AF
X509v3 Authority Key Identifier:
keyid:A4:AF:6F:39:B0:6F:62:88:02:0C:21:6E:27:51:3D:97:45:B9:B7:AF
DirName:/C=FR/ST=P.A.C.A./L=Cavaillon/O=B2PWeb/OU=Certificate Authority/CN=gitlab.b2pweb.com/emailAddress=root@gitlab.b2pweb.com
serial:E8:8C:90:F4:11:D4:A1:0F
X509v3 Basic Constraints:
CA:TRUE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
Signature Algorithm: sha1WithRSAEncryption
3d:2c:a0:63:69:3f:00:a0:07:59:58:a8:9e:66:48:2a:b4:2a:
ae:d6:4e:aa:19:e7:5f:a6:65:5c:a9:b1:0b:08:38:46:63:27:
96:da:4b:9d:bc:58:a2:c8:a9:db:43:5c:e5:0a:3f:be:d6:79:
05:ae:a0:fe:a6:fa:55:eb:20:d9:17:a0:47:8e:5c:20:d7:c6:
a1:2b:d7:35:d7:49:10:2e:1e:75:f4:b2:2b:69:3b:41:67:0c:
45:18:bf:9a:79:2d:0f:a9:8c:0b:0d:8a:87:f3:f1:a9:03:19:
e5:3e:d2:4b:5e:60:4a:34:1f:25:cb:38:a3:4e:5c:59:a5:ce:
4c:c6:42:6e:ec:01:97:e7:a9:1e:cb:16:d2:1e:d5:ec:26:2d:
87:d8:7c:f9:87:3a:65:44:89:fb:96:63:11:44:96:43:f2:45:
55:99:3a:18:fa:4f:4f:68:04:a1:0c:f9:96:bc:43:76:ff:f0:
35:51:ff:f3:c4:73:60:dd:3a:79:d8:7e:e0:a5:ea:13:df:7c:
a6:00:f3:14:6b:fd:2c:c5:bd:76:5b:39:1e:2a:04:87:86:55:
6f:8a:5f:b5:97:27:b7:60:16:75:92:0a:48:e8:42:9e:97:a3:
0c:0a:14:b6:ff:64:2c:36:fa:52:b5:c0:34:21:e1:df:84:18:
75:74:bd:2b
Press [enter] to continue
=====================================================================
B2PWeb Certificate Management System
=====================================================================
1) Create a Client/Server/OCSP certificate
2) Create a Client Certificate for Web (PKCS#12)
3) Renew a Certificate
4) Revoke a Certificate
5) List Certificates
i) Initialize Root Certificate Authority (CA)
r) Regenerate CRL
d) Delete CA
o) Show/Modify/Save CA Options
q) Quit
Options available before init
p) Change PKI default path [/etc/pki]
n) Change CA name [httpd]
==> Make your choice [none]: 1
-----------------------------------------------------------------
Create a client certificate
-----------------------------------------------------------------
==> User name [NONE]: gitlab.b2pweb.com
==> User email [NONE]: root@gitlab.b2pweb.com
==> Select Usage Key (server, client or ocsp) [client]: server
Add OCSP Extension to Certificate ? [Y/n]: n
-----------------------------------------------------------------
Hostname: gitlab.b2pweb.com
Admin email: root@gitlab.b2pweb.com
-----------------------------------------------------------------
Create server certificate with this parameters ? [Y/n]:
Using configuration from /etc/pki/httpd/ssl2.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jan 17 11:10:06 2014 GMT
Not After : Jan 17 11:10:06 2015 GMT
Subject:
countryName = FR
stateOrProvinceName = P.A.C.A.
organizationName = B2PWeb
organizationalUnitName = Admin
commonName = gitlab.b2pweb.com
emailAddress = root@gitlab.b2pweb.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DA:15:C0:0C:00:DE:0F:40:E5:2C:70:A3:13:43:72:D5:07:A6:76:CF
X509v3 Authority Key Identifier:
keyid:A4:AF:6F:39:B0:6F:62:88:02:0C:21:6E:27:51:3D:97:45:B9:B7:AF
DirName:/C=FR/ST=P.A.C.A./L=Cavaillon/O=B2PWeb/OU=Certificate Authority/CN=gitlab.b2pweb.com/emailAddress=root@gitlab.b2pweb.com
serial:E8:8C:90:F4:11:D4:A1:0F
Certificate is to be certified until Jan 17 11:10:06 2015 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Press [enter] to continue
Mise en place de la conf Apache
Les fichiers permettant la connexion en http et https sont simplement téléchargés afin de mixer les deux pour notre besoin.
wget -O /etc/httpd/conf.d/gitlab.conf.bak https://raw.github.com/gitlabhq/gitlab-recipes/master/web-server/apache/gitlab.conf
wget -O /etc/httpd/conf.d/gitlab-ssl.conf.bak https://raw.github.com/gitlabhq/gitlab-recipes/master/web-server/apache/gitlab-ssl.conf
Fichier <path>/etc/httpd/conf.d/gitlab-ssl.conf</path> qui est un mix des deux fichiers téléchargés précédemment.
<pre>
#This configuration has been tested on GitLab 6.0.0 and GitLab 6.0.1
#Note this config assumes unicorn is listening on default port 8080.
#Module dependencies
# mod_rewrite
# mod_ssl
# mod_proxy
# mod_proxy_http
# mod_headers
# This section is only needed if you want to redirect http traffic to https.
# You can live without it but clients will have to type in https:// to reach gitlab.
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:80>
ServerName gitlab.b2pweb.com
ServerSignature Off
ProxyPreserveHost On
<Location />
Order deny,allow
Allow from all
ProxyPassReverse http://127.0.0.1:8080
ProxyPassReverse http://gitlab.b2pweb.com/
</Location>
#apache equivalent of nginx try files
# http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
# http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
RewriteEngine on
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
# needed for downloading attachments
DocumentRoot /var/lib/git/gitlab/public
#Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
ErrorDocument 404 /404.html
ErrorDocument 422 /422.html
ErrorDocument 500 /500.html
ErrorDocument 503 /deploy.html
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
ErrorLog logs/gitlab.b2pweb.com_error.log
CustomLog logs/gitlab.b2pweb.com_forwarded.log common_forwarded
CustomLog logs/gitlab.b2pweb.com_access.log combined env=!dontlog
CustomLog logs/gitlab.b2pweb.com.log combined
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
#strong encryption ciphers only
#see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
SSLCipherSuite SSLv3:TLSv1:+HIGH:!SSLv2:!MD5:!MEDIUM:!LOW:!EXP:!ADH:!eNULL:!aNULL
SSLCertificateFile /etc/pki/httpd/certs/gitlab.b2pweb.com-root@gitlab.b2pweb.com.crt
SSLCertificateKeyFile /etc/pki/httpd/private/gitlab.b2pweb.com-root@gitlab.b2pweb.com.key
SSLCACertificateFile /etc/pki/httpd/httpdca.crt
ServerName gitlab.b2pweb.com
ServerSignature Off
ProxyPreserveHost On
<Location />
Order deny,allow
Allow from all
ProxyPassReverse http://127.0.0.1:8080
ProxyPassReverse http://gitlab.b2pweb.com/
</Location>
#apache equivalent of nginx try files
# http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files
# http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab
RewriteEngine on
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
RequestHeader set X_FORWARDED_PROTO 'https'
# needed for downloading attachments
DocumentRoot /var/lib/git/gitlab/public
#Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up.
ErrorDocument 404 /404.html
ErrorDocument 422 /422.html
ErrorDocument 500 /500.html
ErrorDocument 503 /deploy.html
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
ErrorLog logs/gitlab.b2pweb.com_error_ssl.log
CustomLog logs/gitlab.b2pweb.com_forwarded_ssl.log common_forwarded
CustomLog logs/gitlab.b2pweb.com_access_ssl.log combined env=!dontlog
CustomLog logs/gitlab.b2pweb.com_ssl.log combined
</VirtualHost>
On redémarre Apache
service httpd restart
En tant qu'utilisateur git
su - git
gem install charlock_holmes --version '0.6.9.4'
cd gitlab
bundle install --deployment --without development test postgres
bundle exec rake gitlab:setup RAILS_ENV=production
bundle exec rake gitlab:env:info RAILS_ENV=production
Compilation des assets
bundle exec rake assets:precompile RAILS_ENV=production
Vérification
Vérifier gitlab-shell
/var/lib/git/gitlab-shell/bin/check
Check GitLab API access: OK
Check directories and files:
/var/lib/git/repositories/: OK
/var/lib/git/.ssh/authorized_keys: OK
Test redis-cli executable: redis-cli 2.4.10
Send ping to redis server: PONG
Vérifier les variables d'environnement
La commande est à lancer depuis la racine de gitlab (<path>/var/lib/git/gitlab</path>)
bundle exec rake gitlab:env:info RAILS_ENV=production
System information
System: CentOS release 6.5 (Final)
Current User: git
Using RVM: no
Ruby Version: 2.0.0p353
Gem Version: 2.0.14
Bundler Version:1.5.2
Rake Version: 10.1.0
GitLab information
Version: 6.4.3
Revision: 3173626
Directory: /var/lib/git/gitlab
DB Adapter: mysql2
URL: http://gitlab.b2pweb.com
HTTP Clone URL: http://gitlab.b2pweb.com/some-project.git
SSH Clone URL: git@gitlab.b2pweb.com:some-project.git
Using LDAP: no
Using Omniauth: no
GitLab Shell
Version: 1.8.0
Repositories: /var/lib/git/repositories/
Hooks: /var/lib/git/gitlab-shell/hooks/
Git: /usr/bin/git
Vérifier gitlab
La commande est à lancer depuis la racine de gitlab (<path>/var/lib/git/gitlab</path>)
bundle exec rake gitlab:check RAILS_ENV=production
Checking Environment ...
Git configured for git user? ... yes
Has python2? ... yes
python2 is supported version? ... yes
Checking Environment ... Finished
Checking GitLab Shell ...
GitLab Shell version >= 1.7.9 ? ... OK (1.8.0)
Repo base directory exists? ... yes
Repo base directory is a symlink? ... no
Repo base owned by git:git? ... yes
Repo base access is drwxrws---? ... yes
update hook up-to-date? ... yes
update hooks in repos are links: ...
Didier Fabert / Koji ... ok
Didier Fabert / Nagios Plugins ... ok
Didier Fabert / RPM ... ok
Didier Fabert / Bascule PRA ... ok
Didier Fabert / By-Pass LDirector ... ok
Gilles Gaudin / Bash scripts ... repository is empty
Didier Fabert / CMan ... ok
Didier Fabert / Conf Call ... ok
Didier Fabert / DNS ... ok
Didier Fabert / Get Ossec blocked IP ... ok
Didier Fabert / iDrac ... ok
Didier Fabert / Incident ... ok
Didier Fabert / Logos ... ok
Didier Fabert / LogRotate ... ok
Didier Fabert / LogWatch ... ok
Didier Fabert / Make Spec ... ok
Didier Fabert / Mount VIP ... ok
Didier Fabert / MySQL Replication ... ok
Didier Fabert / MySQL Master-Master Replication Status ... ok
Didier Fabert / MySQL Restart Replication ... ok
Didier Fabert / MySQL Slow Log to HTML ... ok
Didier Fabert / NConf ... ok
Didier Fabert / NFS DRBD Init Script ... ok
Didier Fabert / Nightly Scripts ... ok
Didier Fabert / Noreply Email Process ... ok
Didier Fabert / Phone Queue Monitoring ... ok
Didier Fabert / Purge Engine Logs ... ok
Didier Fabert / Shinken Pack Koji ... ok
Didier Fabert / Shinken Pack Zimbra ... ok
Didier Fabert / Sysbench ... ok
Didier Fabert / Watch Mail Logs ... ok
Didier Fabert / Webservice Monitoring ... ok
Didier Fabert / Xen Monitoring ... ok
Didier Fabert / Zimbra Check Quota ... ok
Didier Fabert / Zimbra Live Sync ... ok
Didier Fabert / Zimbra Replication ... ok
Didier Fabert / Zimbra CLI Command Simulator ... ok
Didier Fabert / Save Joyau Scripts ... repository is empty
Didier Fabert / Save LAN Scripts ... repository is empty
Didier Fabert / Save Prod Scripts ... repository is empty
Didier Fabert / Yet Another Xen Monitoring ... ok
Running /var/lib/git/gitlab-shell/bin/check
Check GitLab API access: OK
Check directories and files:
/var/lib/git/repositories/: OK
/var/lib/git/.ssh/authorized_keys: OK
Test redis-cli executable: redis-cli 2.4.10
Send ping to redis server: PONG
gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Sidekiq ...
Running? ... yes
Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking LDAP ...
LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab ...
Database config exists? ... yes
Database is SQLite ... no
All migrations up? ... yes
GitLab config exists? ... yes
GitLab config outdated? ... no
Log directory writable? ... yes
Tmp directory writable? ... yes
Init script exists? ... yes
Init script up-to-date? ... no
Try fixing it:
Redownload the init script
For more information see:
doc/install/installation.md in section "Install Init Script"
Please fix the error above and rerun the checks.
projects have namespace: ...
Didier Fabert / Koji ... yes
Didier Fabert / Nagios Plugins ... yes
Didier Fabert / RPM ... yes
Didier Fabert / Bascule PRA ... yes
Didier Fabert / By-Pass LDirector ... yes
Gilles Gaudin / Bash scripts ... yes
Didier Fabert / CMan ... yes
Didier Fabert / Conf Call ... yes
Didier Fabert / DNS ... yes
Didier Fabert / Get Ossec blocked IP ... yes
Didier Fabert / iDrac ... yes
Didier Fabert / Incident ... yes
Didier Fabert / Logos ... yes
Didier Fabert / LogRotate ... yes
Didier Fabert / LogWatch ... yes
Didier Fabert / Make Spec ... yes
Didier Fabert / Mount VIP ... yes
Didier Fabert / MySQL Replication ... yes
Didier Fabert / MySQL Master-Master Replication Status ... yes
Didier Fabert / MySQL Restart Replication ... yes
Didier Fabert / MySQL Slow Log to HTML ... yes
Didier Fabert / NConf ... yes
Didier Fabert / NFS DRBD Init Script ... yes
Didier Fabert / Nightly Scripts ... yes
Didier Fabert / Noreply Email Process ... yes
Didier Fabert / Phone Queue Monitoring ... yes
Didier Fabert / Purge Engine Logs ... yes
Didier Fabert / Shinken Pack Koji ... yes
Didier Fabert / Shinken Pack Zimbra ... yes
Didier Fabert / Sysbench ... yes
Didier Fabert / Watch Mail Logs ... yes
Didier Fabert / Webservice Monitoring ... yes
Didier Fabert / Xen Monitoring ... yes
Didier Fabert / Zimbra Check Quota ... yes
Didier Fabert / Zimbra Live Sync ... yes
Didier Fabert / Zimbra Replication ... yes
Didier Fabert / Zimbra CLI Command Simulator ... yes
Didier Fabert / Save Joyau Scripts ... yes
Didier Fabert / Save LAN Scripts ... yes
Didier Fabert / Save Prod Scripts ... yes
Didier Fabert / Yet Another Xen Monitoring ... yes
Projects have satellites? ...
Didier Fabert / Koji ... yes
Didier Fabert / Nagios Plugins ... yes
Didier Fabert / RPM ... yes
Didier Fabert / Bascule PRA ... yes
Didier Fabert / By-Pass LDirector ... yes
Gilles Gaudin / Bash scripts ... yes
Didier Fabert / CMan ... yes
Didier Fabert / Conf Call ... yes
Didier Fabert / DNS ... yes
Didier Fabert / Get Ossec blocked IP ... yes
Didier Fabert / iDrac ... yes
Didier Fabert / Incident ... yes
Didier Fabert / Logos ... yes
Didier Fabert / LogRotate ... yes
Didier Fabert / LogWatch ... yes
Didier Fabert / Make Spec ... yes
Didier Fabert / Mount VIP ... yes
Didier Fabert / MySQL Replication ... yes
Didier Fabert / MySQL Master-Master Replication Status ... yes
Didier Fabert / MySQL Restart Replication ... yes
Didier Fabert / MySQL Slow Log to HTML ... yes
Didier Fabert / NConf ... yes
Didier Fabert / NFS DRBD Init Script ... yes
Didier Fabert / Nightly Scripts ... yes
Didier Fabert / Noreply Email Process ... yes
Didier Fabert / Phone Queue Monitoring ... yes
Didier Fabert / Purge Engine Logs ... yes
Didier Fabert / Shinken Pack Koji ... yes
Didier Fabert / Shinken Pack Zimbra ... yes
Didier Fabert / Sysbench ... yes
Didier Fabert / Watch Mail Logs ... yes
Didier Fabert / Webservice Monitoring ... yes
Didier Fabert / Xen Monitoring ... yes
Didier Fabert / Zimbra Check Quota ... yes
Didier Fabert / Zimbra Live Sync ... yes
Didier Fabert / Zimbra Replication ... yes
Didier Fabert / Zimbra CLI Command Simulator ... yes
Didier Fabert / Save Joyau Scripts ... yes
Didier Fabert / Save LAN Scripts ... yes
Didier Fabert / Save Prod Scripts ... yes
Didier Fabert / Yet Another Xen Monitoring ... yes
Redis version >= 2.0.0? ... yes
Your git bin path is "/usr/bin/git"
Git version >= 1.7.10 ? ... yes (1.8.3)
Checking GitLab ... Finished