How To Secure GitLab Server with SSL Certificate

In our earlier articles, we covered the installation of GitLab CE on Ubuntu, Debian, CentOS, and Fedora Linux distributions. In today’s article, we will see how you can secure GitLab Server with SSL Certificate. Access to GitLab will be via HTTPS protocol.

There are two scenarios we’ll consider for configuring GitLab HTTPS access:

• Secure GitLab Server with a Commercial SSL Certificate – E.g DigiCert, Comodo e.t.c
• Secure GitLab Server with Let’s Encrypt SSL Certificate

If you’re interested in doing a fresh installation of GitLab CE on your new server, these guides should come in handy:

Install Gitlab CE on Ubuntu 18.04 / Debian 9

Install Gitlab CE on CentOS 7 / Fedora 29 / Fedora 28

Secure GitLab Server with a Commercial SSL Certificate

Commercial SSL certificates is a DV (Domain Validation) trustworthy certificate supported by all popular web browsers. You’ll purchase this certificate from a trusted, commercial Certificate Authority (CA) such as Comodo, DigiCert, GeoTrust e.t.c.

After purchasing your certificate, download the Certificate file and put it with the private key to the /etc/gitlab/ssl/ directory.

/etc/gitlab/ssl/git.example.com.key
/etc/gitlab/ssl/git.example.com.crt

Then configure SSL settings on your /etc/gitlab/gitlab.rb file. First, change external URL from http to https

external_url 'https://git.example.com'

Under the ## GitLab NGINX section, enable Nginx and provide SSL key and certificate paths.

nginx['enable'] = true
nginx['client_max_body_size'] = '250m'
nginx['redirect_http_to_https'] = true

nginx['ssl_certificate'] = "/etc/gitlab/ssl/git.example.com.key"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/git.example.com.crt"
nginx['ssl_protocols'] = "TLSv1.1 TLSv1.2"

Other SSL settings are commented, you can read them and make changes you fit for your deployment. When done, run the following command to effect the changes:

sudo gitlab-ctl reconfigure

Wait for the command to finish executing then visit the URL https://git.example.com to Login to your GitLab dashboard.

Secure GitLab Server with Let’s Encrypt SSL Certificate

Open the file /etc/gitlab/gitlab.rband look for Let's Encrypt integration section.

Note that you need a Domain name with Valid A record pointing to your GitLab server to get a Let’s Encrypt certificate. Set your server hostname to DNS name with a  valid A record:

sudo hostnamectl set-hostname git.example.com --static

The compulsory settings are:

letsencrypt['enable'] = true
letsencrypt['contact_emails'] = ['[email protected]'] # This should be an array of email addresses to add as contacts
letsencrypt['auto_renew'] = true

You can also specify the autorenew hour and day of the month for your certificate

letsencrypt['auto_renew_hour'] = 3
letsencrypt['auto_renew_day_of_month'] = "*/7"

When done, run the following command to effect the changes:

sudo gitlab-ctl reconfigure

Your reconfiguration should return a success for https to work on GitLab server. To validate GitLab settings, run the command:

$ sudo gitlab-rake gitlab:check  

Checking GitLab Shell ...
GitLab Shell version >= 8.4.1 ? ... OK (8.4.1)
hooks directories in repos are links: ... can't check, you have no projects
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Redis available via internal API: OK

Access to /var/opt/gitlab/.ssh/authorized_keys: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished
Checking Gitaly ...
default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Running? ... yes
Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Reply by email is disabled in config/gitlab.yml
Checking LDAP ...
Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
Checking LDAP ... Finished

Checking GitLab ...
Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ... can't check, you have no projects
Redis version >= 2.8.0? ... yes
Ruby version >= 2.3.5 ? ... yes (2.4.5)
Git version >= 2.9.5 ? ... yes (2.18.1)
Git user has default SSH configuration? ... yes
Active users: ... 2

Checking GitLab ... Finished