{"id":400,"date":"2016-08-07T08:34:42","date_gmt":"2016-08-07T07:34:42","guid":{"rendered":"https:\/\/www.carinato.net\/?p=400"},"modified":"2016-08-07T08:34:42","modified_gmt":"2016-08-07T07:34:42","slug":"installare-gitlab-in-debian-8-con-certificato-lets-encrypt","status":"publish","type":"post","link":"https:\/\/carinato.com\/?p=400","title":{"rendered":"Installare GitLab in Debian 8 con certificato Let&#8217;s Encrypt"},"content":{"rendered":"<p>Da utente root:<\/p>\n<pre>su -\n\napt-get update &amp;&amp; apt-get install curl<\/pre>\n<p>Installo certbot<\/p>\n<pre>echo \"deb http:\/\/ftp.debian.org\/debian jessie-backports main\" &gt;&gt; \/etc\/apt\/sources.list\n\napt-get update &amp;&amp; apt-get install certbot -t jessie-backports<\/pre>\n<p>Creo il\u00a0file di configurazione di letsencrypt per gitlab.(<strong>cambiare\u00a0gitlab.yourdomain.com con il nome del vostro sito e your@email.com con il vostro indirizzo email<\/strong>)<\/p>\n<p>Il dominio <strong>mattermost.yourdomain.com<\/strong> serve per abilitare anche la chat inclusa in gitlab (cambiare\u00a0<strong>yourdomain.com <\/strong>col vostro dominio)<\/p>\n<pre>mkdir -p \/root\/letsencrypt-config \ncat &lt;&lt;EOT &gt;&gt; \/root\/letsencrypt-config\/gitlab.ini\n# this is the let's Encrypt config for our gitlab instance\n\n# use the webroot authenticator. \n authenticator = webroot\n# the following path needs to be served by our webserver\n# to validate our domains\n webroot-path = \/var\/www\/letsencrypt\n\n# generate certificates for the specified domains.\ndomains = <strong>gitlab.yourdomain.com, mattermost.yourdomain.com<\/strong>\n\n# register certs with the following email address\nemail = <strong>your@email.com<\/strong>\n\n# use a 4096 bit RSA key instead of 2048\nrsa-key-size = 4096\nEOT<\/pre>\n<p>Creo una cartella per la verifica del sito<\/p>\n<pre>mkdir -p \/var\/www\/letsencrypt<\/pre>\n<p>Installo Gitlab<\/p>\n<pre>curl https:\/\/packages.gitlab.com\/install\/repositories\/gitlab\/gitlab-ce\/script.deb.sh | bash\napt-get install gitlab-ce<\/pre>\n<p>Modifico il file di configurazione di Gitlab impostando il nome del sito (<strong>cambiare\u00a0gitlab.yourdomain.com con il nome del vostro sito<\/strong>)<\/p>\n<pre>vi \/etc\/gitlab\/gitlab.rb<\/pre>\n<pre>external_url \"http:\/\/<strong>gitlab.yourdomain.com<\/strong>\"<\/pre>\n<p>Per abilitare la chat <em>mattermost<\/em> modificare anche la seguente riga:<\/p>\n<pre class=\"p1\"><span class=\"s1\">mattermost_external_url 'http:\/\/<strong>mattermost.<\/strong><\/span><strong>yourdomain.com<\/strong><span class=\"s1\">'<\/span><\/pre>\n<p>Aggiungo al file di configurazione delle linee per utilizzare le chiavi e per attivare l&#8217;invio della posta. Modificare opportunamente le variabili evidenziate<\/p>\n<pre>cat &lt;&lt;EOT &gt;&gt; \/etc\/gitlab\/gitlab.rb\n### Customize NGINX\nnginx['redirect_http_to_https'] = true\nnginx['ssl_certificate']= \"\/etc\/letsencrypt\/live\/<strong>gitlab.yourdomain.com<\/strong>\/fullchain.pem\"\nnginx['ssl_certificate_key'] = \"\/etc\/letsencrypt\/live\/<strong>gitlab.yourdomain.com<\/strong>\/privkey.pem\"\n\nnginx['custom_gitlab_server_config']=\"location ^~ \/.well-known {\\n alias \/var\/www\/letsencrypt\/.well-known;\\n}\\n\"\n\n### SMTP\ngitlab_rails['smtp_enable'] = true\ngitlab_rails['smtp_address'] = \"smtp.gmail.com\"\ngitlab_rails['smtp_port'] = 587\ngitlab_rails['smtp_user_name'] = \"<strong>my.email@gmail.com<\/strong>\"\ngitlab_rails['smtp_password'] = \"<strong>my-gmail-password<\/strong>\"\ngitlab_rails['smtp_domain'] = \"smtp.gmail.com\"\ngitlab_rails['smtp_authentication'] = \"login\"\ngitlab_rails['smtp_enable_starttls_auto'] = true\ngitlab_rails['smtp_tls'] = false\ngitlab_rails['smtp_openssl_verify_mode'] = 'peer'\nEOT<\/pre>\n<p>Per configurare\u00a0anche la chat M<em>attermost<\/em> aggiungere le seguenti righe:<\/p>\n<pre>cat &lt;&lt;EOT &gt;&gt; \/etc\/gitlab\/gitlab.rb\n<span class=\"s1\">mattermost_nginx['custom_gitlab_mattermost_server_config'] = \"location ^~ \/.well-known {\\n alias \/var\/www\/letsencrypt\/.well-known;\\n}\\n\"<\/span>\n<span class=\"s1\">mattermost['enable'] = true<\/span>\n<span class=\"s1\">mattermost['gitlab_auth_endpoint'] = \"https:\/\/<strong>gitlab.yourdomain.com<\/strong>\/oauth\/authorize\"<\/span>\n<span class=\"s1\">mattermost['gitlab_token_endpoint'] = \"https:\/\/<\/span><span class=\"s1\"><strong>gitlab.yourdomain.com<\/strong><\/span><span class=\"s1\">\/oauth\/token\"<\/span>\n<span class=\"s1\">mattermost['gitlab_user_api_endpoint'] = \"https:\/\/<strong>gitlab.yourdomain.com<\/strong>\/api\/v3\/user\"<\/span>\n<span class=\"s1\">mattermost_nginx['redirect_http_to_https'] = true<\/span>\n<span class=\"s1\">mattermost_nginx['ssl_certificate'] = \"\/etc\/letsencrypt\/live\/<strong>gitlab.yourdomain.com<\/strong>\/fullchain.pem\"<\/span>\n<span class=\"s1\">mattermost_nginx['ssl_certificate_key'] = \"\/etc\/letsencrypt\/live\/<strong>gitlab.yourdomain.com<\/strong>\/privkey.pem\"<\/span>\n<span class=\"s1\">mattermost['email_enable_sign_up_with_email'] = true<\/span>\n<span class=\"s1\">mattermost['email_enable_sign_in_with_email'] = true<\/span>\n<span class=\"s1\">mattermost['email_enable_sign_in_with_username'] = true<\/span>\n<span class=\"s1\">mattermost['email_send_email_notifications'] = true<\/span>\n<span class=\"s1\">mattermost['email_require_email_verification'] = false<\/span>\n<span class=\"s1\">mattermost['email_smtp_username'] = <\/span>\"<strong>my.email@gmail.com<\/strong>\"\n<span class=\"s1\">mattermost['email_smtp_password'] = \"<\/span><strong>my-gmail-password<\/strong><span class=\"s1\">\"<\/span>\n<span class=\"s1\">mattermost['email_smtp_server'] = \"smtp.gmail.com\"<\/span>\n<span class=\"s1\">mattermost['email_smtp_port'] = 587<\/span>\n<span class=\"s1\">mattermost['email_connection_security'] = \"STARTTLS\"\nEOT<\/span><\/pre>\n<p>Per altre configurazioni smtp vedi: <a href=\"https:\/\/gitlab.com\/gitlab-org\/omnibus-gitlab\/blob\/master\/doc\/settings\/smtp.md\">https:\/\/gitlab.com\/gitlab-org\/omnibus-gitlab\/blob\/master\/doc\/settings\/smtp.md<\/a><\/p>\n<p>Riconfiguro GITLAB<\/p>\n<pre>gitlab-ctl reconfigure<\/pre>\n<p>Creo il certificato<\/p>\n<pre>certbot certonly -c \/root\/letsencrypt-config\/gitlab.ini<\/pre>\n<p>Modifico la configurazione impostando https<\/p>\n<pre>vi \/etc\/gitlab\/gitlab.rb<\/pre>\n<pre>external_url \"<strong>https:\/\/gitlab.yourdomain.com<\/strong>\/\"<\/pre>\n<p>anche per M<em>attermost<\/em><\/p>\n<pre class=\"p1\"><span class=\"s1\">mattermost_external_url 'https:\/\/<strong>mattermost.<\/strong><\/span><strong>yourdomain.com<\/strong><span class=\"s1\">'<\/span><\/pre>\n<p>Creo uno script per l&#8217;aggiornamento del certificato<\/p>\n<pre>cat &lt;&lt;EOT &gt;&gt; \/etc\/cron.monthly\/renew-ssl-certificates\n\n#!\/bin\/bash\n\n\/usr\/bin\/certbot certonly -c \/root\/letsencrypt-config\/gitlab.ini --renew-by-default\n# or \/usr\/bin\/certbot renew --quiet\n\ngitlab-ctl restart\nEOT<\/pre>\n<p>Rendo eseguibile lo script<\/p>\n<pre>chmod +x \/etc\/cron.monthly\/renew-ssl-certificates<\/pre>\n<p>Accedo a gitlab con l&#8217;utente root (la password viene richiesta alla prima schermata)<\/p>\n<p>Dall&#8217;area admin &#8211; Settings &#8211; Applications, modifico l&#8217;url dell&#8217;applicazione Mattermost da <strong>http<\/strong> a <strong>https<\/strong><\/p>\n<pre>https:\/\/<strong>mattermost.yourdomain.com<\/strong>\/signup\/gitlab\/complete\n\nhttps:\/\/<strong>mattermost.yourdomain.com<\/strong>\/login\/gitlab\/complete<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Da utente root: su &#8211; apt-get update &amp;&amp; apt-get install curl Installo certbot echo &#8220;deb http:\/\/ftp.debian.org\/debian jessie-backports main&#8221; &gt;&gt; \/etc\/apt\/sources.list apt-get update &amp;&amp; apt-get install certbot -t jessie-backports Creo il\u00a0file di configurazione di letsencrypt per gitlab.(cambiare\u00a0gitlab.yourdomain.com con il nome del vostro sito e your@email.com con il vostro indirizzo email) Il dominio mattermost.yourdomain.com serve per abilitare [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,4],"tags":[],"class_list":["post-400","post","type-post","status-publish","format-standard","hentry","category-linux","category-webutils"],"_links":{"self":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts\/400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=400"}],"version-history":[{"count":0,"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts\/400\/revisions"}],"wp:attachment":[{"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}