Gitlab 系列1 --- 安装

一、概要

1. 环境

(1) CentOS 7.9.2009 (Core)

(2) Rocky Linux 9.3

2. 硬件需求

(1) CPU: 4核

(2) 内存: 4GB

(3) 安装所需空间: 2.5GB

二、安装

1. 安装依赖

(1) CentOS 7

sudo yum install -y policycoreutils-python perl openssh-server

(2) Rocky Linux 9

sudo dnf -y install curl policycoreutils python3-policycoreutils git

2. 启动sshd

sudo systemctl start sshd
sudo systemctl enable sshd
systemctl status sshd

3. 获取安装包

有两种获取安装包的方式，第一种通过脚本将Gitlab CE添加至本地仓库，然后执行yum install下载安装，另一种是手动下载离线安装包；

方法一：

curl -sS https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh | sudo bash

本文选择方法一。

方法二：

(1) 选择目标版本 https://mirrors.tuna.tsinghua.edu.cn/gitlab-ce/yum/el7/

(2) 下载安装包

wget https://mirrors.tuna.tsinghua.edu.cn/gitlab-ce/yum/el7/gitlab-ce-14.8.1-ce.0.el7.x86_64.rpm

3. 安装

(1) 在线安装

sudo yum -y install gitlab-ce

(2) 离线安装

sudo rpm -Uvh gitlab-ce-14.8.1-ce.0.el7.x86_64.rpm

三、配置

1. 配置文件

sudo vi /etc/gitlab/gitlab.rb

2. 基础配置

(1) 访问地址

external_url 'http://[服务器IP]:[服务器端口号]'
external_url 'https://gitlab.example.com'

3. Prometheus

(1) 关闭Prometheus

prometheus_monitoring['enable'] = false

3. Puma

puma['worker_processes'] = 2
puma['min_threads'] = 1
puma['max_threads'] = 2

4. postgresql

##! **recommend value is 1/4 of total RAM, up to 14GB.**
postgresql['shared_buffers'] = "1024MB" 
...
postgresql['max_worker_processes'] = 4 #数据库最大并发数

5. sidekiq

sidekiq['max_concurrency'] = 8

6. Nginx

(1) 准备证书

a. 生成私钥

openssl genrsa -out private/gitlab.key 4096

b. 生成CSR

openssl req -new -key private/gitlab.key -out private/gitlab.csr

c. 生成证书

openssl ca -keyfile private/ca.key -cert ca.cert.pem -in private/gitlab.csr -out certs/gitlab.crt

d. 生成DHParam证书

sudo openssl dhparam -out /etc/pki/CA/certs/dhparams.pem 2048

e. 移动证书和密钥

sudo mkdir /etc/gitlab/ssl
sudo mv gitlab.crt /etc/gitlab/ssl
sudo mv gitlab.key /etc/gitlab/ssl
sudo mv ca.crt /etc/gitlab/ssl
sudo mv dhparams.pem /etc/gitlab/ssl
sudo chmod -R 755 /etc/gitlab

(2) 日志目录

sudo mkdir -p /var/log/gitlab/nginx
sudo chmod -R 755 /var/log/gitlab

(3) 配置

nginx['redirect_http_to_https'] = true
nginx['ssl_client_certificate'] = "/etc/gitlab/ssl/ca.crt"
nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab.key"
nginx['ssl_dhparam'] = "/etc/gitlab/ssl/dhparams.pem"
...
nginx['custom_error_pages'] = {
  '404' => {
    'title' => 'URL not found!',
    'header' => 'URL not found!',
    'message' => 'The resource that you request is not found!'
  }
}
...
nginx['log_directory'] = "/var/log/gitlab/nginx"
nginx['error_log_level'] = "warn"
nginx['worker_processes'] = 4

7. 加载配置

(1) 每次修改配置文件后均需要执行以下命令来重新加载配置项：

sudo gitlab-ctl reconfigure

(2) 获取初始用户名和密码

uid: root

pwd(该初始密钥有效期为首次登录后的24小时): 

sudo cat /etc/gitlab/initial_root_password

(3) 修改密码

https://gitlab.example.com/-/profile/password/edit

8. 防火墙

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-port=端口号/tcp
sudo systemctl reload firewalld

9. 测试

此时，你就可以通过访问external_url里面配置的地址来访问Gitlab了。

四、集成LDAP

1. 禁用用户管理

因为接下来我们会使用LDAP的账号，所以Gitlab自带的User and Account Management可以关闭，我们回到：

manage_accounts['enable'] = false

2. 配置 /etc/gitlab/gitlab.rb

(1) 不启用SSL

gitlab_rails['ldap_enabled'] = true

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
   main: # 'main' is the GitLab 'provider ID' of this LDAP server
     label: 'LDAP'
     host: '127.0.0.1' //LDAP server的host
     port: 389 //LDAP server的端口号
     uid: 'uid'
     bind_dn: 'cn=admin,dc=example,dc=com' //需要绑定的LDAP节点，可以理解为Gitlab访问LDAP服务的账号
     password: 'xxxxxx' //LDAP节点对应的密码
     encryption: 'plain' # "start_tls" or "simple_tls" or "plain" //加密方式
     verify_certificates: true
     active_directory: false //这里不是AD
     allow_username_or_email_login: true
     lowercase_usernames: false
     block_auto_created_users: false
     base: 'ou=People,dc=example,dc=com'
     user_filter: ''
     attributes:
       username: ['uid', 'userid', 'sAMAccountName']
       email: ['mail', 'email', 'userPrincipalName']
       name: 'cn'
       first_name: 'givenName'
       last_name:  'sn'
EOS

(2) 启用SSL

gitlab_rails['ldap_enabled'] = true

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
   main: # 'main' is the GitLab 'provider ID' of this LDAP server
     label: 'LDAP'
     host: '127.0.0.1' //LDAP server的host
     port: 389 //LDAP server的端口号
     uid: 'uid'
     bind_dn: 'cn=admin,dc=example,dc=com' //需要绑定的LDAP节点，可以理解为Gitlab访问LDAP服务的账号
     password: 'xxxxxx' //LDAP节点对应的密码
     encryption: 'start_tls' # "start_tls" or "simple_tls" or "plain" //加密方式
     tls_options:
       ca_file: /etc/ssl/certs/ca.cert.pem
     verify_certificates: true
     active_directory: false //这里不是AD
     allow_username_or_email_login: true
     lowercase_usernames: false
     block_auto_created_users: false
     base: 'ou=People,dc=example,dc=com'
     user_filter: ''
     attributes:
       username: ['uid', 'userid', 'sAMAccountName']
       email: ['mail', 'email', 'userPrincipalName']
       name: 'cn'
       first_name: 'givenName'
       last_name:  'sn'
EOS

3. 重载配置

sudo gitlab-ctl reconfigure

4. 校验LDAP配置

sudo gitlab-rake gitlab:ldap:check

此时访问Gitlab网站，会出现：

五、卸载

1. 卸载

sudo yum -y remove gitlab-ce
sudo dnf -y remove gitlab-ce

2. 删除目录

sudo rm -rf /var/opt/gitlab
sudo rm -rf /etc/gitlab

六、参考

1. 官方

https://about.gitlab.com/install/#centos-7

https://docs.gitlab.com/omnibus/

https://docs.gitlab.com/ee/install/requirements.html

https://docs.gitlab.com/omnibus/installation/index.html

https://docs.gitlab.com/omnibus/settings/rpi.html

2. Rocky Linux

https://computingforgeeks.com/install-gitlab-on-rocky-almalinux-9/

3. 其他

https://www.howtoforge.com/tutorial/how-to-install-and-configure-gitlab-ce-on-centos-7/

https://kifarunix.com/integrate-gitlab-with-openldap-for-authentication/