GitLab可通过IP访问，配置Nginx代理域名后出现404错误

在192.168.1.124部署Docker版Nginx Proxy Manager，反向代理192.168.1.186的GitLab CE服务器。当gitlab.rb中external_url设为http://192.168.1.186时，可通过git.payhas.com正常访问；但改为https://git.payhas.com后，页面返回404 Not Found，直接访问192.168.1.186则正常。

服务器环境均为Ubuntu 22.04：

• 192.168.1.124：Docker版Nginx Proxy Manager
• 192.168.1.186：GitLab CE
• 192.168.1.165：GitLab-runner

相关配置 #

GitLab服务器（192.168.1.186）配置 #

/etc/nginx/sites-available/default

server { 
    listen 80 default_server; listen [::]:80 default_server;

    root /var/www/html; index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / { 
        try_files $uri $uri/ =404;
    } 
}

/etc/nginx/sites-available/gitlab（官方文档配置）

upstream gitlab-workhorse { server unix:/home/git/gitlab/tmp/sockets/gitlab-workhorse.socket fail_timeout=0; }

map $http_upgrade $connection_upgrade_gitlab { default upgrade; close; }

log_format gitlab_access '$remote_addr - $remote_user [$time_local] "$request_method $gitlab_filtered_request_uri $server_protocol" $status $body_bytes_sent "$gitlab_filtered_http_referer" "$http_user_agent"';

map $request_uri $gitlab_temp_request_uri_1 { default $request_uri; ~(?i)^(?<start>.)(?<temp>[?&]private[-_]token)=[^&](?<rest>.*)$ &quot;$start$temp=[FILTERED]$rest&quot;; }

map $gitlab_temp_request_uri_1 $gitlab_temp_request_uri_2 { default $gitlab_temp_request_uri_1; ~(?i)^(?<start>.)(?<temp>[?&]authenticity[-_]token)=[^&](?<rest>.*)$ &quot;$start$temp=[FILTERED]$rest&quot;; }

map $gitlab_temp_request_uri_2 $gitlab_filtered_request_uri { default $gitlab_temp_request_uri_2; ~(?i)^(?<start>.)(?<temp>[?&]feed[-_]token)=[^&](?<rest>.*)$ &quot;$start$temp=[FILTERED]$rest&quot;; }

map $http_referer $gitlab_filtered_http_referer { default $http_referer; ~^(?<temp>.*)? $temp; }

server { listen 0.0.0.0:80; listen [::]:80; server_name git.payhas.com; server_tokens off;

real_ip_header X-Real-IP; real_ip_recursive off;

access_log /var/log/nginx/gitlab_access.log gitlab_access; error_log /var/log/nginx/gitlab_error.log;

location / { client_max_body_size 0; gzip off; proxy_read_timeout 300; proxy_connect_timeout 300; proxy_redirect off; proxy_http_version 1.1;

proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade_gitlab;

proxy_pass http://gitlab-workhorse; }

error_page 404 /404.html; error_page 422 /422.html; error_page 500 /500.html; error_page 502 /502.html; error_page 503 /503.html;

location ~ ^/(404|422|500|502|503).html$ { root /home/git/gitlab/public; internal; } }

gitlab.rb配置

external_url 'https://git.payhas.com' 
nginx['enable'] = false 
web_server['external_users'] = ['www-data'] 
gitlab_rails['trusted_proxies'] = [ '192.168.1.124/24' ] 
nginx['listen_port'] = 80 
nginx['listen_https'] = false

已将www-data用户加入gitlab-www组。

Nginx Proxy Manager（192.168.1.124）配置 #

• 域名：git.payhas.com
• 协议：http
• 转发IP：192.168.1.186
• 转发端口：80

1. 启用GitLab的Nginx站点配置 #

GitLab自定义Nginx配置文件未链接到sites-enabled目录时，Nginx会走默认配置返回404，执行以下命令启用：

sudo ln -s /etc/nginx/sites-available/gitlab /etc/nginx/sites-enabled/
sudo systemctl reload nginx

2. 修正代理转发的协议头部 #

当external_url设为HTTPS时，GitLab期望请求的X-Forwarded-Proto为https，但当前NPM用HTTP转发时，传递的$scheme是http，导致GitLab生成的资源路径不匹配。

修改NPM配置：

• 方式一：将代理协议改为https
• 方式二：保持HTTP转发，在NPM的自定义Nginx配置中添加：

  proxy_set_header X-Forwarded-Proto https;
  

3. 重新加载GitLab配置 #

确保gitlab.rb的信任代理设置生效：

sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

4. 检查Workhorse Socket权限 #

确保www-data用户能访问GitLab Workhorse的socket文件：

sudo chown git:gitlab-www /home/git/gitlab/tmp/sockets/gitlab-workhorse.socket
sudo chmod 0660 /home/git/gitlab/tmp/sockets/gitlab-workhorse.socket

5. 日志排查定位问题 #

查看GitLab服务器的Nginx日志，确认请求是否匹配到git.payhas.com的server块：

tail -f /var/log/nginx/gitlab_access.log
tail -f /var/log/nginx/gitlab_error.log

如果日志中无请求记录，说明Nginx未匹配到对应站点配置，需检查站点是否启用、域名解析是否正确。

内容的提问来源于stack exchange，提问作者said_devops_team