From ca133858890ed33071ff21ef8681ee976d1e20c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20Fra=C3=9F?=
 <christian.frass@dielinke-glauchau.de>
Date: Fri, 22 Mar 2024 13:19:22 +0100
Subject: [PATCH] [fix] role:gitlab-and-nginx

---
 ansible/roles/gitlab-and-nginx/info.md        |  4 +
 .../roles/gitlab-and-nginx/templates/conf.j2  | 93 +++++++++++++++++--
 2 files changed, 87 insertions(+), 10 deletions(-)
 create mode 100644 ansible/roles/gitlab-and-nginx/info.md

diff --git a/ansible/roles/gitlab-and-nginx/info.md b/ansible/roles/gitlab-and-nginx/info.md
new file mode 100644
index 0000000..490a155
--- /dev/null
+++ b/ansible/roles/gitlab-and-nginx/info.md
@@ -0,0 +1,4 @@
+## Verweise
+
+- [GitLab | Dokumentation | Using a non-bundled web-server](https://docs.gitlab.com/omnibus/settings/nginx.html#using-a-non-bundled-web-server)
+- [GitLab | Dokumentation | nginx-conf-template](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/support/nginx/gitlab-ssl)
diff --git a/ansible/roles/gitlab-and-nginx/templates/conf.j2 b/ansible/roles/gitlab-and-nginx/templates/conf.j2
index 79d1004..eabfcb9 100644
--- a/ansible/roles/gitlab-and-nginx/templates/conf.j2
+++ b/ansible/roles/gitlab-and-nginx/templates/conf.j2
@@ -1,35 +1,108 @@
+upstream gitlab-workhorse {
+	server unix:/home/git/gitlab/tmp/sockets/gitlab-workhorse.socket fail_timeout=0;
+}
+
+map $http_upgrade $connection_upgrade_gitlab_ssl {
+	default upgrade;
+	'' close;
+}
+
+log_format gitlab_ssl_access '$remote_addr - $remote_user [$time_local] "$request_method $gitlab_ssl_filtered_request_uri $server_protocol" $status $body_bytes_sent "$gitlab_ssl_filtered_http_referer" "$http_user_agent"';
+
+map $request_uri $gitlab_ssl_temp_request_uri_1 {
+	default $request_uri;
+	~(?i)^(?<start>.*)(?<temp>[\?&]private[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
+}
+
+map $gitlab_ssl_temp_request_uri_1 $gitlab_ssl_temp_request_uri_2 {
+	default $gitlab_ssl_temp_request_uri_1;
+	~(?i)^(?<start>.*)(?<temp>[\?&]authenticity[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
+}
+
+map $gitlab_ssl_temp_request_uri_2 $gitlab_ssl_filtered_request_uri {
+	default $gitlab_ssl_temp_request_uri_2;
+	~(?i)^(?<start>.*)(?<temp>[\?&]feed[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
+}
+
+map $http_referer $gitlab_ssl_filtered_http_referer {
+	default $http_referer;
+	~^(?<temp>.*)\? $temp;
+}
+
 server {
 	listen 80 default_server;
 	listen [::]:80 ipv6only=on default_server;
 	
 	server_name {{var_gitlab_and_nginx_domain}};
+	server_tokens off;
 	
-	return 301 https://$server_name$request_uri; access_log /var/log/nginx/gitlab_access.log;
+	return 301 https://$http_host$request_uri;
 	
+	access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
 	error_log /var/log/nginx/gitlab_error.log;
 }
 
 server {
-	listen 443 ssl default_server;
-	listen [::]:443 ipv6only=on ssl default_server;
+	listen 0.0.0.0:443 ssl http2;
+	listen [::]:443 ipv6only=on ssl http2 default_server;
 	
 	server_name {{var_gitlab_and_nginx_domain}};
+	server_tokens off;
 	
 	ssl_certificate /etc/ssl/fullchains/{{var_gitlab_and_nginx_domain}}.pem;
 	ssl_certificate_key /etc/ssl/private/{{var_gitlab_and_nginx_domain}}.pem;
 	
-	server_tokens off; location ~ /.well-known {
-		allow all;
-	}
-
+	ssl_session_timeout 1d;
+	ssl_session_cache shared:SSL:10m;
+	ssl_session_tickets off;
+	
+	ssl_protocols TLSv1.3;
+	ssl_prefer_server_ciphers off;
+	
+	# ssl_stapling on;
+	# ssl_stapling_verify on;
+	# ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
+	# resolver 208.67.222.222 208.67.222.220 valid=300s; # Can change to your DNS resolver if desired
+	# resolver_timeout 5s;
+	
+	# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
+	
+	real_ip_header X-Real-IP;
+	real_ip_recursive off;
+	
+	access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
+	error_log /var/log/nginx/gitlab_error.log;
+	
 	location / {
-		proxy_pass http://localhost:8081;
+		client_max_body_size 0;
+		gzip off;
+		
+		proxy_read_timeout 300;
+		proxy_connect_timeout 300;
 		proxy_redirect off;
+		
+		proxy_http_version 1.1;
+		
 		proxy_set_header Host $http_host;
 		proxy_set_header X-Real-IP $remote_addr;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 		proxy_set_header X-Forwarded-Proto $scheme;
-		proxy_set_header X-Forwarded-Protocol $scheme;
-		proxy_set_header X-Url-Scheme $scheme;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade_gitlab;
+		
+		# proxy_pass http://gitlab-workhorse;
+		proxy_pass http://localhost:8080;
+	}
+	
+	error_page 404 /404.html;
+	error_page 422 /422.html;
+	error_page 500 /500.html;
+	error_page 502 /502.html;
+	error_page 503 /503.html;
+	
+	location ~ ^/(404|422|500|502|503)\.html$ {
+		root /home/git/gitlab/public;
+		internal;
 	}
 }
+