mkdir -p /data/gitlab/config
mkdir -p /data/gitlab/logs
mkdir -p /data/gitlab/data

version: '3.8'
services:
  gitlab:
    image: gitlab/gitlab-ce:18.2.4-ce.0
    container_name: gitlab
    restart: always
    hostname: gitlab.example.com
    ports:
      - "8080:80"    # 給 Nginx 代理
      - "8443:443"   # 如果想用 GitLab 自帶 https，可選
      - "2222:22"    # ssh 克隆用
    volumes:
      - /data/gitlab/config:/etc/gitlab
      - /data/gitlab/logs:/var/log/gitlab
      - /data/gitlab/data:/var/opt/gitlab

docker-compose up -d

#指定域名   
#注意：為什么這里不寫https//gitlab.example.com，如果寫了https，gitLab內(nèi)置nginx和外層nginx沖突，gitLab內(nèi)部nginx會(huì)嘗試啟用443，而外層Nginx也在管443，結(jié)果請求來回繞，容易訪問502。
external_url 'http://gitlab.example.com'   
# 如果 ssh 用 2222 端口，需要加上：
gitlab_rails['gitlab_shell_ssh_port'] = 2222
#因?yàn)橛昧薔ginx 反向代理，那就 關(guān)閉 GitLab 的內(nèi)置證書申請
letsencrypt['enable'] = false

docker exec -it gitlab gitlab-ctl reconfigure

#殺掉進(jìn)程（如果出現(xiàn)執(zhí)行重載配置是卡住可選擇操作）
docker exec -it gitlab pkill -9 -f "cinc-client"
docker exec -it gitlab gitlab-ctl reconfigure
#查看組件是否正常（各個(gè)組件顯示run就說明ok）
docker exec -it gitlab gitlab-ctl status
#GitLab 在 容器第一次初始化時(shí)，會(huì)生成一個(gè)隨機(jī)的 root 密碼，默認(rèn)的登錄方式是：
用戶名：root
密碼：保存在容器掛載的配置目錄里（/etc/gitlab/initial_root_password）
#查看宿主機(jī)掛載位置
cat /data/gitlab/config/initial_root_password
#會(huì)有類似輸出（?。?！如果更改過root密碼就不會(huì)更新這個(gè)文件了）
# WARNING: This value is valid only in the following conditions
# ...
Password: AbCdEfGhIjKlMnOpQrSt
# ...
#如果密碼忘記，可以進(jìn)入容器里重置
docker exec -it gitlab gitlab-rails console -e production
#在控制臺輸入
user = User.find_by_username('root')
user.password = '你的新密碼'
user.password_confirmation = '你的新密碼'
user.save!

#拉取nginx鏡像
docker pull nginx:1.26.2	
#創(chuàng)建持久化目錄
mkdir -p /data/nginx/cert
mkdir -p /data/nginx/conf/conf.d
mkdir -p /data/nginx/html
mkdir -p /data/nginx/logs

user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    #tcp_nopush     on;
    keepalive_timeout  65;
    #gzip  on;
    client_max_body_size 200m;
    client_body_timeout 300;
    include /etc/nginx/conf.d/*.conf;
}

server {
    listen 80;
    server_name gitlab.example.com; # 替換為你的域名
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name gitlab.example.com; # 替換為你的域名
    ssl_session_timeout 30m;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_certificate /etc/nginx/cert/certificate.pem; # 替換為你的 SSL 證書路徑
    ssl_certificate_key /etc/nginx/cert/private.key; # 替換為你的 SSL 私鑰路徑
    ssl_session_cache shared:SSL:10m;
    location / {
        client_max_body_size 256m;
        proxy_pass http://localhost:8080; # 替換為 GitLab 容器的 IP 或域名
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_intercept_errors on;
    }
    # GitLab WebSocket 支持（例如 CI/CD 終端）
    location /-/ {
        proxy_pass http://localhost:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

systemctl restart nginx

https://gitlab.example.com  #訪問你自己的域名