gitlab runner 【x509: certificate relies on legacy Common Name field, use SANs instead】 And 【x509: certificate signed by unknown authority】

https://gitlab.com/gitlab-org/gitlab-runner/-/issues/28841

【x509: certificate relies on legacy Common Name field, use SANs instead】

1. Change all example.com for your domain

openssl genrsa -out ca.key 2048

openssl req -new -x509 -days 365 -key ca.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=Acme Root CA" -out ca.crt

openssl req -newkey rsa:2048 -nodes -keyout example.com.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=*.example.com" -out example.com.csr

openssl x509 -req -extfile <(printf "subjectAltName=DNS:example.com,DNS:www.example.com") -days 365 -in example.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out example.com.crt

2. Put crt and key to gitlab ssl. Stop gitlab. Start gitlab.

Check gitlab have new DNS

openssl s_client -connect example.com:443 /dev/null | openssl x509 -noout -text | grep DNS:

3. if have 【x509: certificate signed by unknown authority】

gitlab-runner register --tls-ca-file="Use just create crt file"

gitlab old version backup restore upgrade

check version   http://xxx.xxx.xxx.xxx/help

1. https://packages.gitlab.com/gitlab/gitlab-ce




2. example https://packages.gitlab.com/gitlab/gitlab-ce/packages/el/7/gitlab-ce-9.5.4-ce.0.el7.x86_64.rpm

curl -s https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh | sudo bash
sudo yum install gitlab-ce-9.5.4-ce.0.el7.x86_64

ps: https://docs.gitlab.com/omnibus/manual_install.html



3. http://sueboy.blogspot.com/2018/12/gitlab.html

sudo nano /etc/gitlab/gitlab.rb

可以在裡面找到external_url

sudo gitlab-ctl reconfigure
sudo gitlab-ctl status


4. open firewall

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --list-all --permanent


5. backup restore
https://docs.gitlab.com/ee/raketasks/backup_restore.html
https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/raketasks/backup_restore.md


6. upgrade
https://docs.gitlab.com/omnibus/update/

gitlab Maintenance Policy   Upgrade recommendations
https://docs.gitlab.com/ee/policy/maintenance.html#upgrade-recommendations

9.5 to 10
https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/update/9.5-to-10.0.md



================================

目前已經在測試環境模擬過，安全可行方式：

1. 建立一台新的centos
2. 灌gitlab 9.5.4，還原 目前9.5.4，確認是否能正常執行gitlab
3. 開始升級 9.5.4 -> 11.5.5 會失敗，必需 9.5.4 -> 9.5.10 -> 10.8.7 -> 11.3.4 -> 11.5.5，必需按照這個步驟升級4次
4. gitlab 11.5.5升級完後，請人員操作測試是否有問題，沒問題後，再把舊的關閉，切換ip

個人帳號操作看起來沒有問題，需要其他人測試才能更清楚是否有其他問題

事先準備：

• 升級過程大概需要4小時以上的時間
• 原本gitlab匯出後，不可以再新增資料

A script to backup GitLab repositories.

https://gist.github.com/avence12/70fc35963444d096d1bdb558b252327a
https://www.lightblue.asia/gitlab-backup-script/?doing_wp_cron=1545378263.6541728973388671875000

Change：

1. http token： kzy3x2TSeukztpvzBiYA token from gitlab Personal Access Token, Don't use Account Private Tokens. Need to product Personal Access Token

GLAB_GIT_CLONE_CMD="git clone --quiet --mirror git@${GLAB_GITHOST}:"

GLAB_GIT_CLONE_CMD="git clone --quiet --mirror http://oauth2:${GLAB_TOKEN}@${GLAB_GITHOST}/"

PS：GLAB_TOKEN use in GLAB_PROJ_API, Personal Access Token or Account Private Tokens both is ok

2. REPO have bug：REPO have " must remove, so add line under
https://stackoverflow.com/questions/13570327/how-to-delete-a-substring-using-shell-script

for REPO in $REPOLIST; do

for REPO in $REPOLIST; do
  REPO=${REPO%\"}

3.
GLAB_GITHOST、GLAB_API have gitlab.com change => ip:port or domain


ALL

#!/bin/bash
# A script to backup GitLab repositories.

GLAB_BACKUP_DIR=${GLAB_BACKUP_DIR-"gitlab_backup"}                   # where to place the backup files
GLAB_TOKEN=${GLAB_TOKEN-"YOUR_TOKEN"}        #kzy3x2TSeukztpvzBiYA   # the access token of the account
GLAB_GITHOST=${GLAB_GITHOST-"gitlab.com"}                            # the GitLab hostname
GLAB_PRUNE_OLD=${GLAB_PRUNE_OLD-true}                                # when `true`, old backups will be deleted
GLAB_PRUNE_AFTER_N_DAYS=${GLAB_PRUNE_AFTER_N_DAYS-7}                 # the min age (in days) of backup files to delete
GLAB_SILENT=${GLAB_SILENT-false}                                     # when `true`, only show error messages
GLAB_API=${GLAB_API-"https://gitlab.com/api/v3"}                     # base URI for the GitLab API
GLAB_GIT_CLONE_CMD="git clone --quiet --mirror git@${GLAB_GITHOST}:" # base command to use to clone GitLab repos

TSTAMP=`date "+%Y%m%d"`

# The function `check` will exit the script if the given command fails.
function check {
  "$@"
  status=$?
  if [ $status -ne 0 ]; then
    echo "ERROR: Encountered error (${status}) while running the following:" >&2
    echo "           $@"  >&2
    echo "       (at line ${BASH_LINENO[0]} of file $0.)"  >&2
    echo "       Aborting." >&2
    exit $status
  fi
}

# The function `tgz` will create a gzipped tar archive of the specified file ($1) and then remove the original
function tgz {
   check tar zcf $1.tar.gz $1 && check rm -rf $1
}

$GLAB_SILENT || (echo "" && echo "=== INITIALIZING ===" && echo "")

$GLAB_SILENT || echo "Using backup directory $GLAB_BACKUP_DIR"
check mkdir -p $GLAB_BACKUP_DIR

$GLAB_SILENT || echo -n "Fetching list of repositories ..."
GLAB_PROJ_API="${GLAB_API}/projects?private_token=${GLAB_TOKEN}&per_page=100&simple=true"
echo ${GLAB_PROJ_API}

REPOLIST=`check curl --silent ${GLAB_PROJ_API} | check perl -p -e "s/,/\n/g" | check grep "\"path_with_namespace\"" | check awk -F':"' '{print $2}' | check sed -e 's/"}//g'`

$GLAB_SILENT || echo "found `echo $REPOLIST | wc -w` repositories."

$GLAB_SILENT || (echo "" && echo "=== BACKING UP ===" && echo "")

for REPO in $REPOLIST; do
   REPO=${REPO%\"}
   $GLAB_SILENT || echo "Backing up ${REPO}"
   check ${GLAB_GIT_CLONE_CMD}${REPO}.git ${GLAB_BACKUP_DIR}/${GLAB_ORG}-${REPO}-${TSTAMP}.git && tgz ${GLAB_BACKUP_DIR}/${GLAB_ORG}-${REPO}-${TSTAMP}.git
done

if $GLAB_PRUNE_OLD; then
  $GLAB_SILENT || (echo "" && echo "=== PRUNING ===" && echo "")
  $GLAB_SILENT || echo "Pruning backup files ${GLAB_PRUNE_AFTER_N_DAYS} days old or older."
  $GLAB_SILENT || echo "Found `find $GLAB_BACKUP_DIR -name '*.tar.gz' -mtime +$GLAB_PRUNE_AFTER_N_DAYS | wc -l` files to prune."
  find $GLAB_BACKUP_DIR -name '*.tar.gz' -mtime +$GLAB_PRUNE_AFTER_N_DAYS -exec rm -fv {} > /dev/null \;
fi

$GLAB_SILENT || (echo "" && echo "=== DONE ===" && echo "")
$GLAB_SILENT || (echo "GitLab backup completed." && echo "")

新版gitlab安裝

https://xenby.com/b/131-%E6%8E%A8%E8%96%A6-gitlab%E5%AE%89%E8%A3%9D%E8%88%87%E5%9F%BA%E6%9C%AC%E8%A8%AD%E5%AE%9A%E6%95%99%E5%AD%B8


https://gitlab.com/gitlab-org/gitlab-ce/#installation





sudo nano /etc/gitlab/gitlab.rb

可以在裡面找到external_url

sudo gitlab-ctl reconfigure

gitlab ubuntu 15.10 TortoiseGit

1、virtualbox create vm
2core  ram 2G  hdd 20G

2、download ubuntu 15 server,  best new version iso

3、install ubuntu，no need add any server.

4、change ip dhcp to static  PS：new ubuntu eth0 maybe become to enp0s3 , don't warring.

sudo nano /etc/newwork/interfaces

auto eth0
iface eth0 inet static
address 192.168.x.x #IP位址
netmask 255.255.255.0 #網路遮罩
gateway 192.168.x.x #預設閘道

/etc/init.d/networking restart

5、change dns

sudo nano /etc/newwork/interfaces

dns-nameservers 8.8.8.8 8.8.4.4

 /etc/init.d/networking restart

6、try to connection Internet, if can conntiuum

7、Update system

sudo apt-get update
sudo apt-get upgrade

===========================
8、install gitlab

https://about.gitlab.com/downloads/#ubuntu1404

a、sudo apt-get install curl openssh-server ca-certificates postfix

postfix maybe ask some question：I choose internet like this... not important

b、 step 2 

curl -sS https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash

sudo apt-get update
sudo apt-get upgrade

but get error, so

https://packages.gitlab.com/gitlab/gitlab-ce

curl -LJO https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/wheezy/gitlab-ce_8.3.6-ce.0_amd64.deb/download

dpkg -i gitlab-ce_8.3.6-ce.0_amd64.deb

c、finish install

sudo gitlab-ctl reconfigure

===========================

9、 use web broswer http://your_ip

account:root  password:5iveL!fe

maybe can change same password.

10、create new project

user is root

Private

Private

then create

===========================

11、TortoiseGit for gitlab

a、Git for windows 

https://git-scm.com/download/win

install

b、Download TortoiseGit and language packs

https://tortoisegit.org/download/

install

reboot windows

c、create Public and Private key

run tortoisegit -> PuTTYgen ->Generate  then mouse move move move , let it finish.

．Public key 

一、copy all to     http://your_ip/profile/keys

add ssh key, put in key.  Title is not import by yourself. Better is rsa-key-yyyymmdd.

二、do this step 

http://sueboy.blogspot.tw/2016/04/gitlab-tortoiesgit-git-clone-server.html

．Private key ： click Save private key button. save file. This file is very import.

d、On desktop right click, click git clone

URL：git@your_ip:root/your_project_name.git

putty (key)：choose your Private key

now usually can get file.  Success.

e、Success then right click on folder. TortoiseGit  -> setting -> git

all->

name： by yourself

Email： by yourself

PS：by yourself  is important.  If you git push, this name and email, will in git.

===========================

Now Finish.

gitlab tortoiesgit git clone Server refused our key

This problem is root user, No Have .ssh folder


1、mkdir .ssh
2、chmod 700 .ssh
3、nano authorized_keys
copy gitlab ssh keys, put inside
4、chmod 600 authorized_keys
5、sudo service sshd restart

use tortoiesgit git clone, now usually no error msg :Server refused our key.