容器Traefik与原生GitLab联动：隐藏9043端口实现域名访问

一、修正GitLab配置 #

首先修复external_url的语法错误，并根据访问方式设置正确值：

• 若用子域名https://gitlab.example.com访问：

external_url = "https://gitlab.example.com"

• 若用路径https://example.com/gitlab访问，需额外添加路径根配置：

external_url = "https://example.com/gitlab"
relative_url_root = "/gitlab"

修改后重启GitLab服务生效。

二、调整Traefik配置 #

1. 子域名访问（https://gitlab.example.com） #

修正后的配置如下，核心要点已标注：

http:
  routers:
    gitlab:
      entrypoints: http
      rule: Host(`gitlab.example.com`)
      middlewares: gitlab-https-redirect
      service: gitlab

    gitlab-secure:
      entrypoints: https
      rule: Host(`gitlab.example.com`)
      tls: true
      service: gitlab
  
  middlewares:
    gitlab-https-redirect:
      redirectscheme:
        scheme: https
        permanent: true # 开启永久重定向

  services:
    gitlab:
      loadBalancer:
        servers:
          # Docker环境下用host.docker.internal直接访问主机服务，Linux需加--add-host=host.docker.internal:host-gateway启动参数
          - url: http://host.docker.internal:9043
        # 若GitLab后端用自签HTTPS证书，需禁用证书验证
        serverstransport: gitlab-transport

  # 可选：禁用后端证书验证（自签证书场景）
  serverstransports:
    gitlab-transport:
      insecureSkipVerify: true

2. 路径访问（https://example.com/gitlab） #

需新增路径匹配的路由和路径处理中间件，配合GitLab的路径根配置：

http:
  routers:
    # 保留子域名路由，新增路径访问路由
    gitlab-path:
      entrypoints: http
      rule: Host(`example.com`) && PathPrefix(`/gitlab`)
      middlewares: gitlab-path-redirect, gitlab-path-strip
      service: gitlab

    gitlab-path-secure:
      entrypoints: https
      rule: Host(`example.com`) && PathPrefix(`/gitlab`)
      tls: true
      middlewares: gitlab-path-strip
      service: gitlab

  middlewares:
    gitlab-https-redirect:
      redirectscheme:
        scheme: https
        permanent: true
    # 路径访问的HTTPS重定向
    gitlab-path-redirect:
      redirectscheme:
        scheme: https
        permanent: true
    # 转发前去除/gitlab前缀（若GitLab已设置relative_url_root则可省略）
    gitlab-path-strip:
      stripprefix:
        prefixes:
          - "/gitlab"
        forceSlash: false

  services:
    gitlab:
      loadBalancer:
        servers:
          - url: http://host.docker.internal:9043
        serverstransport: gitlab-transport

  serverstransports:
    gitlab-transport:
      insecureSkipVerify: true

三、关键检查项 #

• 确认DNS解析：gitlab.example.com需指向服务器公网IP
• 确保Traefik容器与主机网络连通，Linux环境启动容器时需加--add-host=host.docker.internal:host-gateway
• 查看Traefik日志，若出现后端连接失败，优先排查网络连通性或证书验证问题

内容的提问来源于stack exchange，提问作者Gavin