I'm configuring a non-bundled nginx server for the Gitlab-Omnibus instance with (1) redirection of HTTP traffic to HTTPS and (2) self-signed certificate.
I am permanently getting loop redirect with the root location.
Here is what curl writes:
F:\tmp>curl.exe -I -L https://localsite.example.com
HTTP/1.1 302 Found
Server: nginx/1.10.2
Date: Mon, 06 Feb 2017 14:47:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: no-cache
Location: http://localsite.example.com
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 889bcd5a-0646-46c1-902a-e569833a3b0d
X-Runtime: 0.032797
X-Xss-Protection: 1; mode=block
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 06 Feb 2017 14:47:49 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://localsite.example.com/
HTTP/1.1 302 Found
Server: nginx/1.10.2
Date: Mon, 06 Feb 2017 14:47:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: no-cache
Location: http://localsite.example.com
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 9be22e5f-07f3-4381-a161-109960cb5338
X-Runtime: 0.039810
X-Xss-Protection: 1; mode=block
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 06 Feb 2017 14:47:49 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://localsite.example.com/
HTTP/1.1 302 Found
Server: nginx/1.10.2
Date: Mon, 06 Feb 2017 14:47:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: no-cache
Location: http://localsite.example.com
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 14f4de36-d327-467a-b3c2-716f11ec5499
X-Runtime: 0.059843
X-Xss-Protection: 1; mode=block
....
curl: (47) Maximum (50) redirects followed
I've taken a recipe from here and here is the relevant part of my nginx.conf
upstream gitlab-workhorse {
server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
}
server {
listen 0.0.0.0:80;
server_name localsite.example.com;
server_tokens off; ## Don't show the nginx version number, a security best practice
return 301 https://$http_host$request_uri;
}
server {
listen 443 ssl default;
server_name localsite.example.com;
ssl on;
ssl_certificate /etc/gitlab/ssl/localsite.example.com.crt;
ssl_certificate_key /etc/gitlab/ssl/localsite.example.com.key;
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
root /opt/gitlab/embedded/service/gitlab-rails/public;
location / {
root /opt/gitlab/embedded/service/gitlab-rails/public;
client_max_body_size 0;
gzip off;
## https://github.com/gitlabhq/gitlabhq/issues/694
## Some requests take more than 30 seconds.
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://gitlab-workhorse;
}
}
Ubuntu 14.04, nginx 1.10.2, installed from PPA.
Other locations don't receive loop redirect. For example, curl.exe -I -L http://localsite.example.com/public, returns 301, then 200.
So, what is wrong?
Update after reading the comment
Yes, this is gitlab-workhorse, that returns Location: http://localsite.example.com. According to docs, it cannot run https.
This is what I've got in logs after enabling debug
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "User-Agent: curl/7.49.0"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Accept: */*"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header:
"HEAD / HTTP/1.1
Host: localsite.example.com
X-Real-IP: 192.168.129.34
X-Forwarded-Ssl: on
X-Forwarded-For: 192.168.129.34
X-Forwarded-Proto: https
Connection: close
User-Agent: curl/7.49.0
Accept: */*
"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 connect to unix:/var/opt/gitlab/gitlab-workhorse/socket, fd:16 #26472
2017/02/07 11:30:41 [debug] 31020#31020: *26471 connected
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http upstream connect: 0
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy status 302 "302 Found"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Cache-Control: no-cache"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Content-Type: text/html; charset=utf-8"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Date: Tue, 07 Feb 2017 08:30:41 GMT"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Location: http://localsite.example.com"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "X-Content-Type-Options: nosniff"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "X-Frame-Options: SAMEORIGIN"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "X-Request-Id: 69b0b688-bdfb-4be5-ae66-d2ddc71c2f96"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "X-Runtime: 0.027523"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "X-Xss-Protection: 1; mode=block"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header: "Connection: close"
2017/02/07 11:30:41 [debug] 31020#31020: *26471 http proxy header done
2017/02/07 11:30:41 [debug] 31020#31020: *26471 posix_memalign: 00007F4038B03F30:4096 @16
2017/02/07 11:30:41 [debug] 31020#31020: *26471 HTTP/1.1 302 Found
Server: nginx
Date: Tue, 07 Feb 2017 08:30:41 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: no-cache
Location: http://localsite.example.com
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 69b0b688-bdfb-4be5-ae66-d2ddc71c2f96
X-Runtime: 0.027523
X-Xss-Protection: 1; mode=block
UPDATE2. It looks like a bug in Gitlab. I've tried to turn off my NGINX and enable bundled one, have got the same redirect loop.
Further updates have brought regression. Version 9.0.5, the bug is here.
However, this can be fixed with Nginx's proxy_redirect directive.
One should replace
proxy_redirect off;
with
proxy_redirect http://localsite.example.com https://localsite.example.com/users/sign_in;