Changing the default Gitlab port

Question

I have installed the latest Gitlab-CE (8.10) on CentOS 7 (fresh install) via the Omnibus package as described here: https://about.gitlab.com/downloads/#centos7

Now, I would like to change the default port at which one can access the Gitlab web interface. To this end, I followed the instructions at http://docs.gitlab.com/omnibus/settings/nginx.html#change-the-default-port-and-the-ssl-certificate-locations, namely I included

external_url "http://127.0.0.1:8765"

in the configuration file /etc/gitlab/gitlab.rb and then updated the configuration with gitlab-ctl reconfigure && gitlab-ctl restart.

However, when I then navigate to http://127.0.0.1:8765, Gitlab keeps redirecting to http://127.0.0.1/users/sign_in, i.e., the port specification is somehow discarded. When I then manually change the URL in the browser to http://127.0.0.1:8765/users/sign_in, it correctly displays the login page and interestingly, all links on the page (e.g., "Explore", "Help") contain the port specification.

In order to fix this behavior, is it necessary to specify the port also somewhere else than in /etc/gitlab/gitlab.rb?

Answer 1

Issue here: https://gitlab.com/gitlab-org/gitlab-ce/issues/20131 Workaround: add this line to /etc/gitlab/gitlab.rb:

nginx['proxy_set_headers'] = { "X-Forward-Port" => "8080", "Host" => "<hostname>:8080" }

replace port and hostname with your values, then as root or with sudo:

gitlab-ctl reconfigure
gitlab-ctl restart

It helps me on Debian 8.5, gitlab-ce from gitlab repo.

Answer 2

In addition of external_url, the documentation also suggests to set a few NGiNX proxy headers:

By default, when you specify external_url, omnibus-gitlab will set a few NGINX proxy headers that are assumed to be sane in most environments.

For example, omnibus-gitlab will set:

"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"

(if you have specified https schema in the external_url).

However, if you have a situation where your GitLab is in a more complex setup like behind a reverse proxy, you will need to tweak the proxy headers in order to avoid errors like The change you wanted was rejected or Can't verify CSRF token authenticity Completed 422 Unprocessable.

This can be achieved by overriding the default headers, eg. specify in /etc/gitlab/gitlab.rb:

 nginx['proxy_set_headers'] = {
  "X-Forwarded-Proto" => "http",
  "CUSTOM_HEADER" => "VALUE"
 }

Save the file and reconfigure GitLab for the changes to take effect.

This way you can specify any header supported by NGINX you require.

The OP ewcz confirms in the comments:

I just uncommented the default settings for nginx['proxy_set_headers'] in /etc/gitlab/gitlab.rb (also, changing X-Forwarded-Proto to http and removing X-Forwarded-Ssl) and suddenly it works!

Answer 3

I changed the etc/gitlab.rb following the comments above and my port did not change.

external_url http://localhost:13080/
...
 nginx['proxy_set_headers'] = {
  "X-Real-IP" => "$remote_addr",
  "X-Forwarded-For" => "$proxy_add_x_forwarded_for",
  "X-Forwarded-Proto" => "https",
  "X-Forwarded-Ssl" => "on",
  "X-Forward-Port" => "13080",
  "Host" => "localhost:13080"
}

gitlab-ctl reconfigure
gitlab-ctl restart