GitLab CE 8.9 升級/遷移到GitLab CE 9.3.4

2020-06-16 16:47:18

這篇文章不記錄Gitlab的使用方法，更不說明Gitlab的特性，只記錄的升級步驟以及遇到的問題。由於升級的版本跨度有點大，Gitlab本身的備份還原並不適合此次的遷移。

部署環境：

阿里雲ECS 4核8G40G CentOS 7.3.1611
阿里雲RDS PostgreSQL 9.4
gitlab-ce-9.3.4-ce.0.el7.x86_64
nginx/1.10.2

遷移流程：
1、在新機器上部署GitLab，我們採用RPM包的方式安裝。
2、編輯/etc/gitlab/gitlab.rb

external_url 'https://gitlab.xxxxx.com' #git的URL，啟用SSL就寫https，反之就寫http
gitlab_rails['time_zone'] = 'UTC'
gitlab_rails['gitlab_email_enabled'] = true #啟用Email
gitlab_rails['gitlab_email_from'] = 'user@host.com'
gitlab_rails['gitlab_email_display_name'] = 'Gitlab email notification'
gitlab_rails['db_adapter'] = "postgresql" #gitlab使用的資料庫，mysql/postgresql
gitlab_rails['db_encoding'] = "utf8"
gitlab_rails['db_collation'] = nil
gitlab_rails['db_database'] = "gitlab_production"
gitlab_rails['db_pool'] = 10
gitlab_rails['db_username'] = "gitlab_user"
gitlab_rails['db_password'] = "*********"
gitlab_rails['db_host'] = "xxxx.pg.aliyun.com"
gitlab_rails['db_port'] = 3433
gitlab_rails['db_socket'] = nil
gitlab_rails['db_sslmode'] = nil
gitlab_rails['db_sslrootcert'] = nil
gitlab_rails['db_prepared_statements'] = true
gitlab_rails['db_statements_limit'] = 1000
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtpdm.aliyun.com"
gitlab_rails['smtp_port'] = 25
gitlab_rails['smtp_user_name'] = "user@host.com"
gitlab_rails['smtp_password'] = "******"
gitlab_rails['smtp_domain'] = "user@host.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = false
postgresql['enable'] = false #禁用自帶postgressql
web_server['external_users'] = ['nginx']
nginx['enable'] = false #禁用自帶nginx
prometheus['enable'] = true
prometheus['monitor_kubernetes'] = true
prometheus['username'] = 'gitlab-prometheus'
prometheus['uid'] = nil
prometheus['gid'] = nil
prometheus['shell'] = '/bin/sh'
prometheus['home'] = '/var/opt/gitlab/prometheus'
prometheus['log_directory'] = '/var/log/gitlab/prometheus'
prometheus['scrape_interval'] = 15
prometheus['scrape_timeout'] = 15
prometheus['chunk_encoding_version'] = 2
prometheus['listen_address'] = '0.0.0.0:9090' #修改prometheus的監聽地址
prometheus_monitoring['enable'] = true

3、由於這台機器有好幾個存取域名，需要共用一個nginx，所以就沒用gitlab自帶的Nginx。
設定nginx:

cat /etc/nginx/nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
worker_connections 1024;
}

http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
'$connection $upstream_addr '
'upstream_response_time $upstream_response_time';

access_log /var/log/nginx/access.log main;

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server_tokens off;

include /etc/nginx/mime.types;
default_type application/octet-stream;
client_body_buffer_size 3072k;
proxy_buffers 16 2048k;
proxy_buffer_size 512k;

connection_pool_size 256;
client_header_buffer_size 1k;
large_client_header_buffers 8 4k;
request_pool_size 4k;
client_max_body_size 128m ;

output_buffers 1 32k;
postpone_output 1460;

ignore_invalid_headers on;

gzip on;
gzip_disable "msie6";
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain application/json application/x-javascript text/css application/xml application/xml+rss text/javascript application/javascript application/soap+xml;
gzip_http_version 1.1;
#gzip_comp_level 6;
# gitlab
proxy_cache_path proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2;
proxy_cache gitlab;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}

# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
}

cat /etc/nginx/conf.d/gitlab-http.conf

upstream gitlab-workhorse {
server unix:/var/opt/gitlab/gitlab-workhorse/socket;
}

server {
listen *:443 ssl http2;

server_name gitlab.xxxx.com;
server_tokens off; ## Don't show the nginx version number, a security best practice

## Increase this if you want to upload large attachments
## Or if you want to accept large git objects over http
client_max_body_size 0;

## Strong SSL Security
## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
ssl on;
ssl_certificate /etc/gitlab/ssl/gitlab.xxxx.com.pem;
ssl_certificate_key /etc/gitlab/ssl/gitlab.xxxx.com.key;

# GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4';
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;

## Real IP Module Config
## http://nginx.org/en/docs/http/ngx_http_realip_module.html

## HSTS Config
## https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
add_header Strict-Transport-Security "max-age=31536000";

## Individual nginx logs for this GitLab vhost
access_log /var/log/nginx/gitlab_access.log main;
error_log /var/log/nginx/gitlab_error.log;

if ($http_host = "") {
set $http_host_with_default "gitlab.xxxx.com";
}

if ($http_host != "") {
set $http_host_with_default $http_host;
}

## If you use HTTPS make sure you disable gzip compression
## to be safe against BREACH attack.
gzip off;

## https://github.com/gitlabhq/gitlabhq/issues/694
## Some requests take more than 30 seconds.
proxy_read_timeout 3600;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_http_version 1.1;

proxy_set_header Host $http_host_with_default;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;

location ~ (.git/gitlab-lfs/objects|.git/info/lfs/objects/batch$) {
proxy_cache off;
proxy_pass http://gitlab-workhorse;
proxy_request_buffering off;
}

location / {
proxy_cache off;
proxy_pass http://gitlab-workhorse;
}

location /assets {
proxy_cache gitlab;
proxy_pass http://gitlab-workhorse;
}

error_page 404 /404.html;
error_page 422 /422.html;
error_page 500 /500.html;
error_page 502 /502.html;
location ~ ^/(404|422|500|502)(-custom)?.html$ {
root /opt/gitlab/embedded/service/gitlab-rails/public;
internal;
}
}

cat /etc/nginx/conf.d/nginx-status.conf

server {
listen *:8060;
server_name localhost;
location /nginx_status {
stub_status on;
server_tokens off;
access_log off;
allow 127.0.0.1;
deny all;
}
}

4、備份原Gitlab的PostgreSQL的資料庫：

# /opt/gitlab/embedded/bin/pg_dump -h xxxx1.pg.rds.aliyuncs.com -p 3433 -U gitlab_user -W gitlabhq_production > gitlabhq_production.sql
# /opt/gitlab/embedded/bin/psql -h xxxx2.pg.rds.aliyuncs.com -p 3433 -U gitlab_user -W gitlabhq_production < gitlabhq_production.sql

備份時可能會由於pg_dump的版本較低，會報錯，可以嘗試替換pg_dump的版本再去備份，（我是直接copy的pg_dump_9.6到當期主機進行的dump）。

5、備份原主機的 /var/opt/gitlab/目錄下的git-data、gitlab-ci 、gitlab-rails/{uploads shared }並copy的新主機上進行目錄替換。

6、將新機器的/etc/gitlab/gitlab-secrets.json替換成原來機器上的，不然會導致gitlab-ci的pipeline報“500 error”。

7、替換完成後就是一系列的檢查、資料遷移、快取清楚等工作

# gitlab-rake gitlab:env:info #檢查環境和設定是否正確
# gitlab-rake gitlab:check #檢查，檢查結果會告訴你如何糾正錯誤。
# gitlab-rake db:migrate #遷移完db後需要執行此步驟。
# gitlab-rake gitlab:shell:setup RAILS_ENV=production #重新生成ssh key
# gitlab-rake cache:clear #清除快取

大體的流程差不多就這些，下面附加一些可能用的操作命令：

登入gitlab自帶的postgreqsl：
#su - gitlab-psql
#gitlab-psql gitlabhq_production
或
#sudo -u gitlab-psql /opt/gitlab/embedded/bin/psql -h /var/opt/gitlab/postgresql -d gitlabhq_production

登入阿里雲RDS-PostgreSQL：
# /opt/gitlab/embedded/bin/psql -h xxxx2.pg.rds.aliyuncs.com -p 3433 -U gitlab_user -W -d gitlabhq_production

登入redis：
#/opt/gitlab/embedded/bin/redis-cli -s /var/opt/gitlab/redis/redis.socket "$@"

更多GitLab相關教學見以下內容：

CentOS 7.2安裝GitLab CE 圖文詳解 http://www.linuxidc.com/Linux/2017-05/143538.htm
CentOS 7下GitLab 9.1.0 安裝及漢化 http://www.linuxidc.com/Linux/2017-04/143240.htm
Ubuntu 14.04搭建GitLab伺服器 http://www.linuxidc.com/Linux/2017-02/140959.htm

GitLab CE 8.9 升級/遷移到GitLab CE 9.3.4

cat /etc/nginx/nginx.conf

cat /etc/nginx/conf.d/gitlab-http.conf

cat /etc/nginx/conf.d/nginx-status.conf

熱門文章