具有單獨 Nginx HTTPS SSL 的 Gitlab 無法正常工作

我有一個 CentOS 7 伺服器（家庭文件伺服器），我試圖用我自己的 Nginx 安裝來設置 Gitlab（所以我也可以將它用於其他事情）。Nginx 版本是 1.10.1。

當我使用推薦的不帶 HTTPS 的 Nginx conf 文件時，它可以工作。但是 HTTPS 版本沒有（即使我創建了一個自簽名證書並指出了這一點）。使用 HTTPS，Chrome 只會說“無法訪問此站點”。

我可以在 Nginx 中創建另一個使用不同名稱的站點，並且它可以使用 HTTPS，所以我不確定出了什麼問題。

工作設置是：

upstream gitlab-workhorse {
 server unix:/var/opt/gitlab/gitlab-workhorse/socket;
}

## Normal HTTP host
server {
 listen 0.0.0.0:80;
 listen [::]:80;
 server_name git.REDACTED; ## Replace this with something like gitlab.example.com
 server_tokens off; ## Don't show the nginx version number, a security best practice
 root /opt/gitlab/embedded/service/gitlab-rails/public;

 ## See app/controllers/application_controller.rb for headers set

 ## Individual nginx logs for this GitLab vhost
 access_log  /var/log/nginx/gitlab_access.log;
 error_log   /var/log/nginx/gitlab_error.log;

 location / {
   client_max_body_size 0;
   gzip off;

   ## https://github.com/gitlabhq/gitlabhq/issues/694
   ## Some requests take more than 30 seconds.
   proxy_read_timeout      300;
   proxy_connect_timeout   300;
   proxy_redirect          off;

   proxy_http_version 1.1;

   proxy_set_header    Host                $http_host;
   proxy_set_header    X-Real-IP           $remote_addr;
   proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
   proxy_set_header    X-Forwarded-Proto   $scheme;

   proxy_pass http://gitlab-workhorse;
 }
}

以及不起作用的 HTTPS 設置：

upstream gitlab-workhorse {
 server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
}

## Redirects all HTTP traffic to the HTTPS host
server {
 listen 80;
 listen [::]:80;
 server_name git.mattval.dynu.com; ## Replace this with something like gitlab.example.com
 server_tokens off; ## Don't show the nginx version number, a security best practice
 return 301 https://$http_host:443$request_uri;
 access_log  /var/log/nginx/gitlab_access.log;
 error_log   /var/log/nginx/gitlab_error.log;
}

## HTTPS host
server {
 listen 443 ssl;
 listen [::]:443 ssl;
 server_name git.REDACTED; ## Replace this with something like gitlab.example.com
 server_tokens off; ## Don't show the nginx version number, a security best practice
 root /opt/gitlab/embedded/service/gitlab-rails/public;

 ## Strong SSL Security
 ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
 ssl on;
 ssl_certificate /etc/nginx/ssl/gitlab.crt;
 ssl_certificate_key /etc/nginx/ssl/gitlab.key;

 # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
 ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_prefer_server_ciphers on;
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 5m;

 ## See app/controllers/application_controller.rb for headers set

 ## Individual nginx logs for this GitLab vhost
 access_log  /var/log/nginx/gitlab_access.log;
 error_log   /var/log/nginx/gitlab_error.log;

 location / {
   client_max_body_size 0;
   gzip off;

   ## https://github.com/gitlabhq/gitlabhq/issues/694
   ## Some requests take more than 30 seconds.
   proxy_read_timeout      300;
   proxy_connect_timeout   300;
   proxy_redirect          off;

   proxy_http_version 1.1;

   proxy_set_header    Host                $http_host;
   proxy_set_header    X-Real-IP           $remote_addr;
   proxy_set_header    X-Forwarded-Ssl     on;
   proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
   proxy_set_header    X-Forwarded-Proto   $scheme;
   proxy_pass http://gitlab-workhorse;
 }
}

好吧，這只是我的錯誤。我正在使用具有動態 DNS 站點的域設置，因此它指向我伺服器的外部地址。但是我的防火牆只允許來自本地 192.168.1.x 子網的網路流量。即使我從本地網路訪問它，它也通過 WAN 並被防火牆阻止。我允許使用防火牆進行訪問，它現在正在工作。

引用自：https://unix.stackexchange.com/questions/299293