1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
Gerrit Code Review - Reverse Proxy
==================================
Description
-----------
Gerrit can be configured to run behind a third-party web server.
This allows the other web server to bind to the privileged port 80
(or 443 for SSL), as well as offloads the SSL processing overhead
from Java to optimized native C code.
Gerrit Configuration
--------------------
Ensure `'$site_path'/etc/gerrit.config` has the property
link:config-gerrit.html#httpd.listenUrl[httpd.listenUrl] configured
to use 'proxy-http://' or 'proxy-https://' and a free port number.
This may have already been configured if proxy support was enabled
during 'init'.
----
[httpd]
listenUrl = proxy-http://127.0.0.1:8081/r/
----
Apache 2 Configuration
----------------------
To run Gerrit behind an Apache server using 'mod_proxy', enable the
necessary Apache2 modules:
----
a2enmod proxy_http
a2enmod ssl ; # optional, needed for HTTPS / SSL
----
Configure an Apache VirtualHost to proxy to the Gerrit daemon,
setting the 'ProxyPass' line to use the 'http://' URL configured
above. Ensure the path of ProxyPass and httpd.listenUrl match,
or links will redirect to incorrect locations.
----
<VirtualHost *>
ServerName review.example.com
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
AllowEncodedSlashes On
ProxyPass /r/ http://127.0.0.1:8081/r/ nocanon
</VirtualHost>
----
The two options 'AllowEncodedSlashes On' and 'ProxyPass .. nocanon' are required
since Gerrit 2.6.
SSL
~~~
To enable Apache to perform the SSL processing, use 'proxy-https://'
in httpd.listenUrl within Gerrit's configuration file, and enable
the SSL engine in the Apache VirtualHost block:
----
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile conf/server.crt
SSLCertificateKeyFile conf/server.key
... same as above ...
</VirtualHost>
----
See the Apache 'mod_ssl' documentation for more details on how to
configure SSL within the server, like controlling how strong of an
encryption algorithm is required.
Troubleshooting
~~~~~~~~~~~~~~~
If you are encountering 'Page Not Found' errors when opening the change
screen, your Apache proxy is very likely decoding the passed URL.
Make sure to either use 'AllowEncodedSlashes On' together with
'ProxyPass .. nodecode' or alternatively a 'mod_rewrite' configuration with
'AllowEncodedSlashes NoDecode' set.
Nginx Configuration
-------------------
To run Gerrit behind an Nginx server, use a server statement such
as this one:
----
server {
listen 80;
server_name review.example.com;
location /r/ {
proxy_pass http://127.0.0.1:8081;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $host;
}
}
----
SSL
~~~
To enable Nginx to perform the SSL processing, use 'proxy-https://'
in httpd.listenUrl within Gerrit's configuration file, and enable
the SSL engine in the Nginx server statement:
----
server {
listen 443;
server_name review.example.com;
ssl on;
ssl_certificate conf/server.crt;
ssl_certificate_key conf/server.key;
... same as above ...
}
----
See the Nginx 'http ssl module' documentation for more details on
how to configure SSL within the server, like controlling how strong
of an encryption algorithm is required.
Troubleshooting
~~~~~~~~~~~~~~~
If you are encountering 'Page Not Found' errors when opening the change
screen, your Nginx proxy is very likely decoding the passed URL.
Make sure to use a 'proxy_pass' URL without any path (esp. no trailing
'/' after the 'host:port').
GERRIT
------
Part of link:index.html[Gerrit Code Review]
|
