gitlab.nginxconf

upstream gitlab {
    server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
}

server {
    listen 80 default_server;
    server_name <change this to your FQDN>;

    rewrite ^ https://$server_name$request_uri? permanent;
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
}

server {
    listen 443 default_server ssl;        
    server_name <change this to your FQDN>; 
    root /home/git/gitlab/public;

    access_log /var/log/nginx/gitlab_ssl_access.log;
    error_log  /var/log/nginx/gitlab_ssl_error.log;

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

    ssl_certificate     /etc/nginx/ssl/gitlab.crt;
    ssl_certificate_key /etc/nginx/ssl/gitlab.key;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1 SSLv3;
    ssl_ciphers TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:TLS_RSA_WITH_AES_256_CBC_SHA256:TLS_RSA_WITH_AES_256_CBC_SHA:TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:TLS_RSA_WITH_3DES_EDE_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:TLS_RSA_WITH_AES_128_CBC_SHA256:TLS_RSA_WITH_AES_128_CBC_SHA:HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
    ssl_prefer_server_ciphers on;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        try_files $uri $uri/index.html $uri.html @gitlab;
    }

    location @gitlab {
        proxy_read_timeout 300;
        proxy_connect_timeout 300;
        proxy_redirect     off;

        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host              $http_host;
        proxy_set_header   X-Real-IP         $remote_addr;

        proxy_pass http://gitlab;
    }
}