Schéma HTTPS perdu dans le scénario proxy Apache lors de la redirection depuis Gitlab

Question

J'ai réussi à configurer Gitlab avec une interface Apache sur mon serveur. Comme le port SSL par défaut est déjà occupé i ajouté un

Listen 444 

aux ports Apache et un hôte virtuel comme

<VirtualHost *:444> 

    ServerSignature Off 

    SSLEngine on 
    SSLCipherSuite ALL:!ADH:!EXP:!eNULL:!aNULL:RC4+RSA:+HIGH:-MEDIUM:!LOW:-SSLv2 
    SSLCertificateFile /etc/apache2/ssl/server.crt 
    SSLCertificateKeyFile /etc/apache2/ssl/server.key 

    RewriteEngine on 
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f 
    RewriteRule ^/(.*)$ balancer://unicornservers%{REQUEST_URI} [P,QSA,L] 

    ProxyPreserveHost On 
    ProxyPass /uploads ! 
    ProxyPass /error ! 

    <Proxy balancer://unicornservers> 
    BalancerMember http://127.0.0.1:8081 
    ProxyPassReverse https://my.server.de:444/ 
    </Proxy> 

    # needed for downloading attachments 
    DocumentRoot /home/git/gitlab/public 

    <Location /> 
    Order deny,allow 
    Allow from all 
    </Location> 

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded 
    ErrorLog /var/log/apache2/gitlab.error.log 
    CustomLog /var/log/apache2/gitlab.forwarded.log common_forwarded 
    CustomLog /var/log/apache2/gitlab.access.log combined env=!dontlog 
    CustomLog /var/log/apache2/gitlab.log combined 

</VirtualHost> 

L'objectif est de transmettre à la licorne locale (ce qui est le scénario standard en utilisant gitlab ce) .

Lorsque vous appelez

https:/my.server.de:444 

je reçois une redirection vers/utilisateurs/sign_in (comme prévu), mais avec le schéma "http" situé dans l'emplacement d'en-tête HTTP. Manuellement, mais à chaque publication, l'emplacement de redirection manque à nouveau le schéma correct. Une idée de ce qui se passe? Le ProxyPassReverse ne devrait-il pas s'en charger?

Answer 1

Il y a une config exemple ici, il a été mis à jour quelques jours auparavant: https://github.com/gitlabhq/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl.conf

Mais il n'a pas vraiment travailler pour moi non plus je devais ajouter:

RequestHeader set X-Forwarded-Proto "https" 

dans la configuration :

<VirtualHost *:8081> 
    SSLEngine on 
    #strong encryption ciphers only 
    #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html 
    SSLCipherSuite SSLv3:TLSv1:+HIGH:!SSLv2:!MD5:!MEDIUM:!LOW:!EXP:!ADH:!eNULL:!aNULL 
    SSLCertificateFile /etc/apache2/ssl/cert.pem 
    SSLCertificateKeyFile /etc/apache2/ssl/cert.key 

    #SSLCACertificateFile /etc/httpd/ssl.crt/your-ca.crt 

    ServerName gitlab.xy 
    ServerSignature Off 

    ProxyPreserveHost On 
    RequestHeader set X-Forwarded-Proto "https" 

    <Location /> 
    Order deny,allow 
    Allow from all 

    ProxyPass http://127.0.0.1:8080 
    ProxyPassReverse http://127.0.0.1:8080 

    </Location> 

    #apache equivalent of nginx try files 
    # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files 
    # http://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab 
    RewriteEngine on 
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f 
    RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] 

    # needed for downloading attachments 
    DocumentRoot /home/git/gitlab/public 

    #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up. 
    ErrorDocument 404 /404.html 
    ErrorDocument 422 /422.html 
    ErrorDocument 500 /500.html 
    ErrorDocument 503 /deploy.html 

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded 
    ErrorLog /var/log/apache2/logs/gitlab-ssl_error.log 
    CustomLog /var/log/apache2/logs/gitlab-ssl_forwarded.log common_forwarded 
    CustomLog /var/log/apache2/logs/gitlab-ssl_access.log combined env=!dontlog 
    CustomLog /var/log/apache2/logs/gitlab-ssl.log combined 

</VirtualHost> 

Answer 2

Cela m'a aidé, notez les lignes ProxyPassReverse. Mon numéro complet et la résolution est au https://stackoverflow.com/a/22390543/3112527.

<IfModule mod_ssl.c> 
<VirtualHost *:443> 
    Servername gitlab.my_domain.com 
    ServerAdmin my_admin@my_domain.com 

    SSLCertificateFile /etc/apache2/ssl.crt/gitlab_my_domain.crt 
    SSLCertificateKeyFile /etc/apache2/ssl.crt/gitlab_my_domain_private.key 
    SSLCACertificateFile /etc/apache2/ssl.crt/gitlab.ca-bundle 

    ##### All the other Apache SSL setup skipped here for StackOverflow #### 

    ProxyPreserveHost On 

    <Location /> 
    # New authorization commands for apache 2.4 and up 
    # http://httpd.apache.org/docs/2.4/upgrading.html#access 
    Require all granted 

    # For relative URL root "host:your_gitlab_port/relative_root" 
    #ProxyPassReverse http://127.0.0.1:8085/gitlab 
    #ProxyPassReverse https://gitlab.my_domain.com/gitlab 

    # For non-relative URL root 
    ProxyPassReverse http://127.0.0.1:8085 
    ProxyPassReverse https://gitlab.my_domain.com/ 
    </Location> 

    # apache equivalent of nginx try files 
    # http://serverfault.com/questions/290784/what-is-apaches-equivalent-of-nginxs-try-files 
    # https://stackoverflow.com/questions/10954516/apache2-proxypass-for-rails-app-gitlab 
    RewriteEngine on 
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f 
    RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] 
    RequestHeader set X_FORWARDED_PROTO 'https' 

    # needed for downloading attachments 
    DocumentRoot /home/git/gitlab/public 

    #Set up apache error documents, if back end goes down (i.e. 503 error) then a maintenance/deploy page is thrown up. 
    ErrorDocument 404 /404.html 
    ErrorDocument 422 /422.html 
    ErrorDocument 500 /500.html 
    ErrorDocument 503 /deploy.html 

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded 
    ErrorLog  /var/log/apache2/gitlab-ssl_error.log 
    CustomLog /var/log/apache2/gitlab-ssl_forwarded.log common_forwarded 
    CustomLog /var/log/apache2/gitlab-ssl_access.log combined env=!dontlog 
    CustomLog /var/log/apache2/gitlab-ssl.log combined 
</VirtualHost> 
</IfModule> 

(de https://github.com/gitlabhq/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl-apache2.4.conf)