1. 硬件要求
##CPU
4 核心500用户
8 核心1000用户
##内存
4 G内存500用户
8 G内存1000用户
2. 下载 链接
3. 安装依赖
yum -y install curl openssh-server postfix wget
4. 安装gitlab组件
yum -y localinstall gitlab-ce-15.9.3-ce.0.el7.x86_64.rpm
5. 修改配置文件
cat > /etc/gitlab/gitlab.rb <<EOF
external_url 'http://gitlab.tom.com'
gitlab_rails['smtp_enable'] = false
gitlab_rails['registry_enabled'] = false
registry['enable'] = false
prometheus['enable'] = false
alertmanager['enable'] = false
node_exporter['enable'] = false
redis_exporter['enable'] = false
postgres_exporter['enable'] = false
gitlab_exporter['enable'] = false
prometheus_monitoring['enable'] = false
EOF
#使用gitlab.rb文件重新生成子配置文件
gitlab-ctl reconfigure
#重启所有gitlab相关文件.
gitlab-ctl restart
#查看gitlab状态
]# gitlab-ctl status
run: gitaly: (pid 31042) 128s; run: log: (pid 30218) 355s
run: gitlab-kas: (pid 31141) 118s; run: log: (pid 30464) 344s
run: gitlab-workhorse: (pid 31147) 117s; run: log: (pid 30632) 294s
run: logrotate: (pid 31157) 117s; run: log: (pid 30173) 367s
run: nginx: (pid 31853) 2s; run: log: (pid 30647) 289s
run: postgresql: (pid 31208) 96s; run: log: (pid 30397) 348s
run: puma: (pid 31197) 97s; run: log: (pid 30575) 306s
run: redis: (pid 31202) 97s; run: log: (pid 30194) 361s
run: sidekiq: (pid 31219) 95s; run: log: (pid 30599) 300s
6. 登录gitlab页面
]# cat /etc/gitlab/initial_root_password
# WARNING: This value is valid only in the following conditions
# 1. If provided manually (either via `GITLAB_ROOT_PASSWORD` environment variable or via `gitlab_rails['initial_root_password']` setting in `gitlab.rb`, it was provided before database was seeded for the first time (usually, the first reconfigure run).
# 2. Password hasn't been changed manually, either via UI or via command line.
#
# If the password shown here doesn't work, you must reset the admin password following https://docs.gitlab.com/ee/security/reset_user_password.html#reset-your-root-password.
Password: fIElM6At23WAaLvZBiy2lzFvOd8Vz8ch96gw3Y0S+HU=
# NOTE: This file will be automatically deleted in the first reconfigure run after 24 hours.
登录用户：root
密码：/etc/gitlab/initial_root_password文件中的Password字段值
7. 汉化
8. 修改密码
9. 关闭注册功能
10. 使用案例
步骤：
1. 创建dev开发组
2. 添加用户tom
3. 用户组添加用户
4. 创建1个项目happy_app并关联dev组
10.1. 创建dev开发组
10.2. 创建用户
10.3. 关联用户到用户组
10.4. 创建项目并关联组
10.5. 普通用户登录gitlab
]# cat /root/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSZ9RvDQpNBc9Hz0vJ8vzQ/bE5Nu7bH9o+krxItSGHvwCCkuducUve0vweyEk52iZRUb3OYAH9Z5GDTFZ+br5sipT/wg8z7FW8g+EhDAOc9adsHSU+hDluKykyw6qLnQ4rX9tIZh6KXrZCiLneRBtfESg+MQvxNYZ8qiAqmiyq3tuz1Wue8KJ/869GvYVoPYDNYt+HBUmSJb9aagVkndXvHvex6ECgRTDrdzoXfpd5HrIlgtvxT46+RnZX5pFiDyUd0K7k9T99VxLQU5oUFUh+YA9glpojleKlOduUa1ld6Lno+StQdAOhKsUYiz31UKwJ5IBE0XCx5OTnG372p0Ib root@jenkins
把用户主机上/root/.ssh/id_rsa.pub 里面的公钥复制到下图1的位置，如果没有此文件，先ssh-keygen生成
已经有远程仓库的代码，需要切换远程仓库地址
#把origin重命名为old-origin
git remote rename origin old-origin
#添加新的origin地址
git remote add origin git@gitlab.tom.com:dev/happy-app.git
#推送所有分支
git push -u origin --all
#推送所有tag
git push -u origin --tags
上面报错是因为此用户权限是developer，无法创建分支，可以用管理员账户把tom用户权限调整为owner.
已经可以看到代码的分支，标签，提交记录
11. 如果gitlab管理员用户名密码忘记，重置方法
gitlab-rake "gitlab:password:reset"
12. gitlab备份与恢复
12.1. gitlab服务配置文件备份
/etc/gitlab目录备份
12.2. 备份gitlab里面的内容
gitlab_rails['manage_backup_path'] = true #是否可以指定备份目录
gitlab_rails['backup_path'] = "/var/opt/gitlab/backups" #备份目录
gitlab_rails['backup_archive_permissions'] = 0600 #备份的压缩包权限
gitlab_rails['backup_keep_time'] = 604800 #备份保留多久 7天
]# egrep -v '^$|^#' /etc/gitlab/gitlab.rb
external_url 'http://gitlab.tom.com'
gitlab_rails['manage_backup_path'] = true
gitlab_rails['backup_path'] = "/var/opt/gitlab/backups"
gitlab_rails['backup_archive_permissions'] = 0600
gitlab_rails['backup_keep_time'] = 604800
gitlab_rails['smtp_enable'] = false
gitlab_rails['registry_enabled'] = false
registry['enable'] = false
prometheus['enable'] = false
alertmanager['enable'] = false
node_exporter['enable'] = false
redis_exporter['enable'] = false
postgres_exporter['enable'] = false
gitlab_exporter['enable'] = false
prometheus_monitoring['enable'] = false
#重新生成子配置文件
]# gitlab-ctl reconfigure
]# gitlab-ctl restart
#手动执行备份命令
]# gitlab-backup create
12.3. gitlab恢复数据
先停止写入数据
[root@gitlab ~]# gitlab-ctl stop puma
ok: down: puma: 0s, normally up
[root@gitlab ~]# gitlab-ctl sidekiq
ok: down: sidekiq: 1s, normally up
执行恢复命令
注意：执行恢复命令的时候，备份文件的名字去除_gitlab_backup.tar，只要前面的部分
~]# ll /var/opt/gitlab/backups/
-rw------- 1 git git 512000 Jul 12 08:40 1720744836_2024_07_12_15.9.3_gitlab_backup.tar
~]# gitlab-backup restore BACKUP=/var/opt/gitlab/backups/1720744836_2024_07_12_15.9.3
12.4. 定时任务备份
#创建备份目录
mkdir -p /backup/gitlab/{code,conf}
chown -R git.root /backup/gitlab/code
#--------------------------------------------------------------
#修改git配置文件中备份文件夹路径
[root@gitlab ~]# egrep -v '^$|^#' /etc/gitlab/gitlab.rb
external_url 'http://gitlab.tom.com'
gitlab_rails['manage_backup_path'] = true
gitlab_rails['backup_path'] = "/backup/gitlab/code/"
gitlab_rails['backup_archive_permissions'] = 0600
gitlab_rails['backup_keep_time'] = 604800
gitlab_rails['smtp_enable'] = false
gitlab_rails['registry_enabled'] = false
registry['enable'] = false
prometheus['enable'] = false
alertmanager['enable'] = false
node_exporter['enable'] = false
redis_exporter['enable'] = false
postgres_exporter['enable'] = false
gitlab_exporter['enable'] = false
prometheus_monitoring['enable'] = false
#重新生成子配置文件
]# gitlab-ctl reconfigure
]# gitlab-ctl restart
#--------------------------------------------------------------
#自动备份脚本
]# cat /server/scripts/backup-gitlab.sh
#!/bin/bash
#1.备份gitlab数据
gitlab-backup create
#2.备份gitlab配置和密码文件
tar zcf /backup/gitlab/conf/gitlab-conf-$(date +%F).tar.gz /etc/gitlab/
#3. 传输到备份服务器
#rsync xxx
#增加定时任务
* 03 * * * /bin/bash /server/scripts/backup-gitlab.sh &> /backup/gitlab/back.log
13. gitlab证书配置
为了防止内网渗透，将gitlab服务的访问添加了ssl,具体步骤如下：
1.gitlab配置https(请先做个快照.)
nginx['enable' ] = true
nginx['client_max_body_size' ]= '250m '
nginx['redirect_http_to_https' ]= true
nginx['redirect_http_to_https _port' ] = 443
nginx['ssl_certificate' ] = "path/ key.crt"
nginx['ssl_certificate_key'] = "path/ key.key"
nginx['ssl_ciphers' ] ="ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"
nginx['ssl_prefer_server_ciphers']= "on"
nginx['ssl_protocols']= "TLSv1.2"
nginx['ssl_session_cache' ] = "builtin:1000shared:sSL: 10m"
nginx['ssl_session_timeout']= "5m"
核心：
nginx['ssl_certificate' ] = 用于指定证书 .crt .pem
nginx['ssl_certificate_key'] = 用于指定私钥 .key
2.gitlab重新配置子项目
gitlab-ctl reconfigure
重启：
gitlab-ctl restart
14. 优化配置
优化暂时不用组件 (选作)
#关闭目前不使用的组件 默认都是true 修改为 false
#关闭prometheus
prometheus['enable'] = false
prometheus['monitor_kubernetes'] = false
#关闭alertmanger
alertmanager['enable'] = false
#关闭exporter 如果需要prometheus监控 则可以打开。
node_exporter['enable'] = false
redis_exporter['enable'] = false
postgres_exporter['enable'] = false
gitlab_monitor['enable'] = false
#gitlab_exporter
prometheus_monitoring['enable'] = false
grafana['enable'] = false