{"action":"created","issue":{"url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/1697","repository_url":"https://api.github.com/repos/sameersbn/docker-gitlab","labels_url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/1697/labels{/name}","comments_url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/1697/comments","events_url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/1697/events","html_url":"https://github.com/sameersbn/docker-gitlab/issues/1697","id":347894659,"node_id":"MDU6SXNzdWUzNDc4OTQ2NTk=","number":1697,"title":"Gitlab and Registry with SSL not working","user":{"login":"lchigami","id":1073878,"node_id":"MDQ6VXNlcjEwNzM4Nzg=","avatar_url":"https://avatars3.githubusercontent.com/u/1073878?v=4","gravatar_id":"","url":"https://api.github.com/users/lchigami","html_url":"https://github.com/lchigami","followers_url":"https://api.github.com/users/lchigami/followers","following_url":"https://api.github.com/users/lchigami/following{/other_user}","gists_url":"https://api.github.com/users/lchigami/gists{/gist_id}","starred_url":"https://api.github.com/users/lchigami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lchigami/subscriptions","organizations_url":"https://api.github.com/users/lchigami/orgs","repos_url":"https://api.github.com/users/lchigami/repos","events_url":"https://api.github.com/users/lchigami/events{/privacy}","received_events_url":"https://api.github.com/users/lchigami/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-06T12:01:34Z","updated_at":"2018-08-06T17:06:59Z","closed_at":"2018-08-06T17:06:59Z","author_association":"NONE","body":"Hi,\r\nI'm trying to setup my Gitlab and Registry with SSL in the same server using compose, but I keep getting the **certificate verify failed** error.\r\n\r\nHere is my **docker-compose.yml**\r\n```\r\nversion: '2'\r\n\r\nservices:\r\n  redis:\r\n    restart: always\r\n    image: sameersbn/redis:latest\r\n    command:\r\n    - --loglevel warning\r\n    volumes:\r\n    - /var/docker/gitlab/redis:/var/lib/redis:Z\r\n    networks:\r\n    - gitlab_network\r\n\r\n  postgresql:\r\n    restart: always\r\n    image: sameersbn/postgresql:10\r\n    volumes:\r\n    - /var/docker/gitlab/postgresql:/var/lib/postgresql:Z\r\n    networks:\r\n    - gitlab_network\r\n    environment:\r\n    - DB_USER=gitlab\r\n    - DB_PASS=OMITTED\r\n    - DB_NAME=OMITTED\r\n    - DB_EXTENSION=OMITTED\r\n\r\n  registry:\r\n    image: registry:2.6.2\r\n    restart: always\r\n    expose:\r\n    - \"5000\"\r\n    ports:\r\n    - \"5000:5000\"\r\n    volumes:\r\n    - /var/docker/gitlab/gitlab/shared/registry:/registry\r\n    - /var/docker/gitlab/gitlab/certs:/certs\r\n    networks:\r\n    - gitlab_network\r\n    environment:\r\n    - REGISTRY_LOG_LEVEL=info\r\n    - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/registry\r\n    - REGISTRY_AUTH_TOKEN_REALM=https://gitlab.abc.def.com/jwt/auth\r\n    - REGISTRY_AUTH_TOKEN_SERVICE=container_registry\r\n    - REGISTRY_AUTH_TOKEN_ISSUER=gitlab-issuer\r\n    - REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE=/certs/registry.crt\r\n    - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt\r\n    - REGISTRY_HTTP_TLS_KEY=/certs/registry.key\r\n    - REGISTRY_STORAGE_DELETE_ENABLED=true\r\n\r\n  gitlab:\r\n    restart: always\r\n    image: sameersbn/gitlab:11.1.4\r\n    depends_on:\r\n    - redis\r\n    - postgresql\r\n    ports:\r\n    - \"80:80\"\r\n      #- \"10022:22\"\r\n    - \"443:443\"\r\n    volumes:\r\n    - /var/docker/gitlab/gitlab:/home/git/data:Z\r\n    - /var/docker/gitlab/gitlab/certs:/certs\r\n    networks:\r\n    - gitlab_network\r\n    environment:\r\n    - DEBUG=false\r\n\r\n    - DB_ADAPTER=OMITTED\r\n    - DB_HOST=OMITTED\r\n    - DB_PORT=OMITTED\r\n    - DB_USER=OMITTED\r\n    - DB_PASS=OMITTED\r\n    - DB_NAME=OMITTED\r\n\r\n    - REDIS_HOST=redis\r\n    - REDIS_PORT=6379\r\n\r\n    - TZ=America/Sao_Paulo\r\n    - GITLAB_TIMEZONE=Brasilia\r\n\r\n    - GITLAB_HTTPS=true\r\n    - SSL_SELF_SIGNED=false\r\n\r\n    - NGINX_HSTS_MAXAGE=259200\r\n\r\n    - GITLAB_REGISTRY_ENABLED=true\r\n    - GITLAB_REGISTRY_HOST=gitlab.abc.def.com\r\n    - GITLAB_REGISTRY_PORT=5000\r\n    - GITLAB_REGISTRY_API_URL=https://registry:5000\r\n    - GITLAB_REGISTRY_KEY_PATH=/certs/registry.key\r\n      #- GITLAB_REGISTRY_CERT_PATH=/certs/registry.crt\r\n    - GITLAB_REGISTRY_ISSUER=gitlab-issuer\r\n    - SSL_REGISTRY_KEY_PATH=/certs/registry.key\r\n    - SSL_REGISTRY_CERT_PATH=/certs/registry.crt\r\n\r\n    - GITLAB_HOST=gitlab.abc.def.com\r\n    - GITLAB_PORT=443\r\n    - GITLAB_SSH_PORT=\r\n    - GITLAB_RELATIVE_URL_ROOT=\r\n    - GITLAB_SECRETS_DB_KEY_BASE=OMITTED\r\n    - GITLAB_SECRETS_SECRET_KEY_BASE=OMITTED\r\n    - GITLAB_SECRETS_OTP_KEY_BASE=OMITTED\r\n\r\n    - GITLAB_ROOT_PASSWORD=\r\n    - GITLAB_ROOT_EMAIL=\r\n\r\n    - GITLAB_NOTIFY_ON_BROKEN_BUILDS=true\r\n    - GITLAB_NOTIFY_PUSHER=false\r\n\r\n    - GITLAB_EMAIL=OMITTED\r\n    - GITLAB_EMAIL_REPLY_TO=OMITTED\r\n    - GITLAB_INCOMING_EMAIL_ADDRESS=OMITTED\r\n\r\n    - GITLAB_BACKUP_SCHEDULE=daily\r\n    - GITLAB_BACKUP_TIME=01:00\r\n\r\n    - SMTP_ENABLED=true\r\n    - SMTP_DOMAIN=OMITTED\r\n    - SMTP_HOST=OMITTED\r\n    - SMTP_PORT=OMITTED\r\n    - SMTP_USER=OMITTED\r\n    - SMTP_PASS=OMITTED\r\n    - SMTP_STARTTLS=true\r\n    - SMTP_AUTHENTICATION=login\r\n\r\n    - IMAP_ENABLED=true\r\n    - IMAP_HOST=OMITTED\r\n    - IMAP_PORT=OMITTED\r\n    - IMAP_USER=OMITTED\r\n    - IMAP_PASS=OMITTED\r\n    - IMAP_SSL=true\r\n    - IMAP_STARTTLS=false\r\n\r\n    - OAUTH_ENABLED=false\r\n    - OAUTH_AUTO_SIGN_IN_WITH_PROVIDER=\r\n    - OAUTH_ALLOW_SSO=\r\n    - OAUTH_BLOCK_AUTO_CREATED_USERS=true\r\n    - OAUTH_AUTO_LINK_LDAP_USER=false\r\n    - OAUTH_AUTO_LINK_SAML_USER=false\r\n    - OAUTH_EXTERNAL_PROVIDERS=\r\n\r\n    - OAUTH_CAS3_LABEL=cas3\r\n    - OAUTH_CAS3_SERVER=\r\n    - OAUTH_CAS3_DISABLE_SSL_VERIFICATION=false\r\n    - OAUTH_CAS3_LOGIN_URL=/cas/login\r\n    - OAUTH_CAS3_VALIDATE_URL=/cas/p3/serviceValidate\r\n    - OAUTH_CAS3_LOGOUT_URL=/cas/logout\r\n\r\n    - OAUTH_GOOGLE_API_KEY=\r\n    - OAUTH_GOOGLE_APP_SECRET=\r\n    - OAUTH_GOOGLE_RESTRICT_DOMAIN=\r\n\r\n    - OAUTH_FACEBOOK_API_KEY=\r\n    - OAUTH_FACEBOOK_APP_SECRET=\r\n\r\n    - OAUTH_TWITTER_API_KEY=\r\n    - OAUTH_TWITTER_APP_SECRET=\r\n\r\n    - OAUTH_GITHUB_API_KEY=\r\n    - OAUTH_GITHUB_APP_SECRET=\r\n    - OAUTH_GITHUB_URL=\r\n    - OAUTH_GITHUB_VERIFY_SSL=\r\n\r\n    - OAUTH_GITLAB_API_KEY=\r\n    - OAUTH_GITLAB_APP_SECRET=\r\n\r\n    - OAUTH_BITBUCKET_API_KEY=\r\n    - OAUTH_BITBUCKET_APP_SECRET=\r\n\r\n    - OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL=\r\n    - OAUTH_SAML_IDP_CERT_FINGERPRINT=\r\n    - OAUTH_SAML_IDP_SSO_TARGET_URL=\r\n    - OAUTH_SAML_ISSUER=\r\n    - OAUTH_SAML_LABEL=\"Our SAML Provider\"\r\n    - OAUTH_SAML_NAME_IDENTIFIER_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:transient\r\n    - OAUTH_SAML_GROUPS_ATTRIBUTE=\r\n    - OAUTH_SAML_EXTERNAL_GROUPS=\r\n    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL=\r\n    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME=\r\n    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME=\r\n    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME=\r\n\r\n    - OAUTH_CROWD_SERVER_URL=\r\n    - OAUTH_CROWD_APP_NAME=\r\n    - OAUTH_CROWD_APP_PASSWORD=\r\n\r\n    - OAUTH_AUTH0_CLIENT_ID=\r\n    - OAUTH_AUTH0_CLIENT_SECRET=\r\n    - OAUTH_AUTH0_DOMAIN=\r\n\r\n    - OAUTH_AZURE_API_KEY=\r\n    - OAUTH_AZURE_API_SECRET=\r\n    - OAUTH_AZURE_TENANT_ID=\r\n\r\n    - LDAP_ENABLED=true\r\n    - LDAP_LABEL=OMITTED\r\n    - LDAP_HOST=OMITTED\r\n    - LDAP_PORT=OMITTED\r\n    - LDAP_UID=sAMAccountName\r\n    - LDAP_METHOD=plain\r\n    - LDAP_VERIFY_SSL=false\r\n    - LDAP_BIND_DN=OMITTED\r\n    - LDAP_PASS=qx4VkuiS\r\n    - LDAP_ACTIVE_DIRECTORY=true\r\n    - LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN=true\r\n    - LDAP_BASE=OMITTED\r\n    - LDAP_USER_FILTER=OMITTED\r\n\r\nnetworks:\r\n  gitlab_network:\r\n    driver: bridge\r\n    ipam:\r\n      driver: default\r\n      config:\r\n      - subnet: 172.16.238.0/24\r\n        gateway: 172.16.238.1\r\n```\r\n\r\nI'm using the same domain to both Gitlab and Registry (**gitlab.abc.def.com**)\r\n`Note: You could also run everything on the same domain and use different ports instead. The required configuration changes below should be straightforward.` \r\n(from https://github.com/sameersbn/docker-gitlab/blob/master/docs/container_registry.md)\r\n\r\nError from **production.log**\r\n```\r\nFaraday::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed):\r\n  lib/container_registry/client.rb:19:in `repository_tags'\r\n  app/models/container_repository.rb:36:in `manifest'\r\n  app/models/container_repository.rb:41:in `tags'\r\n  app/models/container_repository.rb:53:in `has_tags?'\r\n  app/controllers/projects/registry/repositories_controller.rb:48:in `block (2 levels) in ensure_root_container_repository!'\r\n  app/controllers/projects/registry/repositories_controller.rb:47:in `tap'\r\n  app/controllers/projects/registry/repositories_controller.rb:47:in `block in ensure_root_container_repository!'\r\n  app/controllers/projects/registry/repositories_controller.rb:44:in `tap'\r\n  app/controllers/projects/registry/repositories_controller.rb:44:in `ensure_root_container_repository!'\r\n  lib/gitlab/i18n.rb:51:in `with_locale'\r\n  lib/gitlab/i18n.rb:57:in `with_user_locale'\r\n  app/controllers/application_controller.rb:362:in `set_locale'\r\n  lib/gitlab/middleware/multipart.rb:97:in `call'\r\n  lib/gitlab/request_profiler/middleware.rb:14:in `call'\r\n  lib/gitlab/middleware/go.rb:17:in `call'\r\n  lib/gitlab/etag_caching/middleware.rb:11:in `call'\r\n  lib/gitlab/middleware/read_only/controller.rb:38:in `call'\r\n  lib/gitlab/middleware/read_only.rb:16:in `call'\r\n  lib/gitlab/request_context.rb:18:in `call'\r\n  lib/gitlab/metrics/requests_rack_middleware.rb:27:in `call'\r\n  lib/gitlab/middleware/release_env.rb:10:in `call'\r\n```"},"comment":{"url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/comments/410779454","html_url":"https://github.com/sameersbn/docker-gitlab/issues/1697#issuecomment-410779454","issue_url":"https://api.github.com/repos/sameersbn/docker-gitlab/issues/1697","id":410779454,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDc3OTQ1NA==","user":{"login":"lchigami","id":1073878,"node_id":"MDQ6VXNlcjEwNzM4Nzg=","avatar_url":"https://avatars3.githubusercontent.com/u/1073878?v=4","gravatar_id":"","url":"https://api.github.com/users/lchigami","html_url":"https://github.com/lchigami","followers_url":"https://api.github.com/users/lchigami/followers","following_url":"https://api.github.com/users/lchigami/following{/other_user}","gists_url":"https://api.github.com/users/lchigami/gists{/gist_id}","starred_url":"https://api.github.com/users/lchigami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lchigami/subscriptions","organizations_url":"https://api.github.com/users/lchigami/orgs","repos_url":"https://api.github.com/users/lchigami/repos","events_url":"https://api.github.com/users/lchigami/events{/privacy}","received_events_url":"https://api.github.com/users/lchigami/received_events","type":"User","site_admin":false},"created_at":"2018-08-06T17:06:59Z","updated_at":"2018-08-06T17:06:59Z","author_association":"NONE","body":"Resolved!\r\n\r\nThe problem was how the Gitlab was accessing the Registry internal API URL.\r\nChanged\r\n`- GITLAB_REGISTRY_API_URL=https://registry:5000`\r\nto\r\n`- GITLAB_REGISTRY_API_URL=https://gitlab.abc.def.com:5000`"}}
{"actor":{"display_login":"lchigami"}}