GitLab 安装与配置（本地 SonarQube、CI/CD）

2019-01-22  配置  ,  2,210

由于需要，我需要弄一个私有的gitlab，在这里记录一下配置，防止今后踩坑。

坑

外部 Nginx 配置 GitLab

踩了好多坑啊 orz

编辑 /etc/gitlab/gitlab.rb

改以下行为

web_server['external_users'] = ['nginx', 'gitlab-www', 'git']

# ...

nginx['enable'] = false

然后新建一个 gitlab.conf 到 /etc/nginx/conf.d（根据自己 nginx 的配置来，我默认是 include 到 conf.d 文件夹里的所有 .conf）

upstream gitlab-workhorse {
  server unix:/var/opt/gitlab/gitlab-rails/sockets/gitlab.socket fail_timeout=0;
}

map $http_upgrade $connection_upgrade_gitlab_ssl {
    default upgrade;
    ''      close;
}

log_format gitlab_ssl_access $remote_addr - $remote_user [$time_local] "$request_method $gitlab_ssl_filtered_request_uri $server_protocol" $status $body_bytes_sent "$gitlab_ssl_filtered_http_referer" "$http_user_agent";

map $request_uri $gitlab_ssl_temp_request_uri_1 {
  default $request_uri;
  ~(?i)^(?<start>.*)(?<temp>[\?&]private[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
}

map $gitlab_ssl_temp_request_uri_1 $gitlab_ssl_temp_request_uri_2 {
  default $gitlab_ssl_temp_request_uri_1;
  ~(?i)^(?<start>.*)(?<temp>[\?&]authenticity[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
}

map $gitlab_ssl_temp_request_uri_2 $gitlab_ssl_filtered_request_uri {
  default $gitlab_ssl_temp_request_uri_2;
  ~(?i)^(?<start>.*)(?<temp>[\?&]feed[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
}

map $http_referer $gitlab_ssl_filtered_http_referer {
  default $http_referer;
  ~^(?<temp>.*)\? $temp;
}

server {
  ## Either remove "default_server" from the listen line below,
  ## or delete the /etc/nginx/sites-enabled/default file. This will cause gitlab
  ## to be served if you visit any address that your server responds to, eg.
  ## the ip address of the server (http://x.x.x.x/)
  listen 0.0.0.0:80;
  listen [::]:80 ipv6only=on default_server;
  server_name gitlab.example.com; ## Replace this with something like gitlab.example.com
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$http_host$request_uri;
  access_log  /var/log/nginx/gitlab_access.log gitlab_ssl_access;
  error_log   /var/log/nginx/gitlab_error.log;
}

server {
  listen 0.0.0.0:443 ssl;
  listen [::]:443 ipv6only=on ssl default_server;
  server_name gitlab.example.com; ## Replace this with something like gitlab.example.com
  server_tokens off; ## Don't show the nginx version number, a security best practice

  ssl on;
  ssl_certificate /path/to/public.crt;
  ssl_certificate_key /path/to/private.key;

  ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 5m;

  real_ip_header X-Real-IP; ## X-Real-IP or X-Forwarded-For or proxy_protocol
  real_ip_recursive off;    ## If you enable 'on'

  access_log  /var/log/nginx/gitlab_access.log gitlab_ssl_access;
  error_log   /var/log/nginx/gitlab_error.log;

  location / {
    client_max_body_size 0;
    gzip off;

    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_http_version 1.1;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    Upgrade             $http_upgrade;
    proxy_set_header    Connection          $connection_upgrade_gitlab_ssl;

    proxy_pass http://gitlab-workhorse;
  }

  error_page 404 /404.html;
  error_page 422 /422.html;
  error_page 500 /500.html;
  error_page 502 /502.html;
  error_page 503 /503.html;
  location ~ ^/(404|422|500|502|503)\.html$ {
    root /opt/gitlab/embedded/service/gitlab-rails/public;
    internal;
  }
}

但这样做完以后，访问 gitlab 时，所有的 assets 什么资源全部 404、302，解决方法是，编辑 /opt/gitlab/embedded/service/gitlab-rails/config/environments/production.rb

将 config.public_file_server.enabled 改成 true，之后再 sudo gitlab-ctl restart

服务器环境

腾讯云的1核2G服务器，ubuntu 16.04 LTS，官网给出的GitLab配置需求可以在https://docs.gitlab.com/ce/install/requirements.html找到

由于内存太少，需要弄点虚拟内存

sudo swapon -s // 查看当前是否已经有swap分区
sudo fallocate -l 2G /swapfile // 弄一个2G的swapfile分区
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

添加到开机启动sudo vi /etc/fstab，在后面加上

/swapfile            none                 swap       sw                    0 0

GitLab安装

也可以参考https://mirrors.tuna.tsinghua.edu.cn/help/gitlab-ce/

sudo apt-get install git curl openssh-server ca-certificates postfix
curl https://packages.gitlab.com/gpg.key 2> /dev/null | sudo apt-key add - &>/dev/null
sudo vi /etc/apt/sources.list.d/gitlab-ce.list # 加上deb https://mirrors.tuna.tsinghua.edu.cn/gitlab-ce/ubuntu xenial main
sudo apt-get update
sudo apt-get install gitlab-ce

防火墙设置一下

sudo ufw allow http
sudo ufw allow https
sudo ufw allow OpenSSH

查看防火墙状态 sudo ufw status

配置https和邮件，内存优化

编辑 /etc/gitlab/gitlab.rb，更改以下项

external_url 'https://xxx'

### Email Settings
gitlab_rails['gitlab_email_enabled'] = true
gitlab_rails['gitlab_email_from'] = 'gitlab@xxxx.com'
gitlab_rails['gitlab_email_display_name'] = 'GitLab'
gitlab_rails['gitlab_email_reply_to'] = 'gitlab@xxxx.com'
gitlab_rails['gitlab_email_subject_suffix'] = ''

### GitLab email server settings
###! Docs: https://docs.gitlab.com/omnibus/settings/smtp.html
###! **Use smtp instead of sendmail/postfix.**

gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.xxxx.com"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "gitlab@xxxx.com"
gitlab_rails['smtp_password'] = "xxxxxx"
gitlab_rails['smtp_domain'] = "xxxx.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = true

###! **Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert'**
###! Docs: http://api.rubyonrails.org/classes/ActionMailer/Base.html
gitlab_rails['smtp_openssl_verify_mode'] = 'none'

### https
nginx['enable'] = true
nginx['redirect_http_to_https'] = true
nginx['ssl_certificate'] = "/path/to/some.pem"
nginx['ssl_certificate_key'] = "/path/to/some.key"

### optimize memory

unicorn['worker_processes'] = 2
postgresql['shared_buffers'] = "128MB"
postgresql['max_worker_processes'] = 4

然后用以下命令来生效

sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

测试是否能发送邮件

sudo gitlab-rails console
Notify.test_email('your_test_email@test.com', 'xx', 'xx').deliver_now

SonarQube

代码质量很重要的，所以还得搞这么一个玩意

由于服务器太low，估计跑不起SonarQube。。。所以我就想到了一个大但的想法。。在本地虚拟机跑一个SonarQube，当需要看代码质量的时候开虚拟机就好233

所以接下来就是一个ubuntu 16.04.5 LTS单独配SonarQube的说明了

虚拟机装好ubuntu 16.04.5 LTS server后，是不能复制粘贴的。。所以还是用ssh好一点。但刚装好的系统是没有openssh的，所以需要装一下

sudo apt install openssh-server

然后是换源https://mirrors.tuna.tsinghua.edu.cn/help/ubuntu/，用我大清tuna的吧，还免流量呢hhh

接下来是正式装这玩意了

sudo apt install software-properties-common
sudo add-apt-repository ppa:webupd8team/java
sudo apt update
sudo apt install oracle-java8-installer vim unzip postgresql postgresql-contrib

sudo systemctl start postgresql
sudo systemctl enable postgresql
sudo passwd postgres
su postgres
createuser sonar
psql
ALTER USER sonar WITH ENCRYPTED password 'StrongPassword';
CREATE DATABASE sonar OWNER sonar;
\q

wget -c https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-6.7.6.zip
sudo unzip sonarqube-6.7.6.zip -d /opt
sudo mv /opt/sonarqube-6.7.6 /opt/sonarqube
sudo chown -R ubuntu:ubuntu /opt/sonarqube
vim /opt/sonarqube/conf/sonar.properties

修改相关项为

sonar.jdbc.username=sonar
sonar.jdbc.password=StrongPassword
sonar.jdbc.url=jdbc:postgresql://localhost/sonar

然后编辑/etc/systemd/system/sonar.service为

[Unit]
Description=SonarQube service
After=syslog.target network.target

[Service]
Type=forking

ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop

User=ubuntu
Group=ubuntu
Restart=always

[Install]
WantedBy=multi-user.target

然后

sudo systemctl start sonar
sudo systemctl enable sonar

我们还要装一个nginx

sudo apt install nginx

编辑 sudo vim /etc/nginx/sites-available/default，改成

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name localhost;
        location / {
                proxy_pass http://localhost:9000;
        }
}

最后

sudo systemctl restart nginx

现在可以通过ip访问网站了。SonarQube默认用户名密码都是admin。在 Administration -> Marketplace 里搜gitlab，然后装上插件。最后根据插件内容相应设置一下即可。

GitLab Runner

同上，我需要在本地跑runner

sudo apt install docker docker-compose
sudo wget -O /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64
sudo chmod +x /usr/local/bin/gitlab-runner
sudo useradd --comment 'GitLab Runner' --create-home gitlab-runner --shell /bin/bash
sudo gitlab-runner install --user=gitlab-runner --working-directory=/home/gitlab-runner
sudo gitlab-runner start
sudo gitlab-runner register

一把梭下来即可

GiaLab CI/CD Error 500

$ gitlab-rails console
> Ci::Runner.all.update_all(token_encrypted: nil)

$ gitlab-rails dbconsole
> UPDATE projects SET runners_token = null, runners_token_encrypted = null;

.gitlab-ci.yml 能用到的一些环境变量

https://docs.gitlab.com/ce/ci/variables/predefined_variables.html

.gitlab-ci.yml 访问不同的 service

https://docs.gitlab.com/ce/ci/docker/using_docker_images.html#accessing-the-services

使用本地镜像

编辑文件 /etc/gitlab-runner/config.toml，在 [runners.docker] 内加入一句 pull_policy = "if-not-present"

更改一下镜像内的 hosts

编辑文件 /etc/gitlab-runner/config.toml，在 [runners.docker] 内加入一句 extra_hosts = ["xxx.com:127.0.0.1"]

GitLab 协作开发的一些教程

版权属于: Alan Clarke's Blog

原文地址: https://blog.xalanq.com/gitlab-setup/

转载时必须以链接形式注明原始出处及本声明。

欢迎留言>_<

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据。