Synology GitLab SSL

When you want to use an encryption certificate generated by the Synology DSM.

Table Of Contents

1. My environment
2. Stop gitlab package
3. Environment variables setting
4. Port setting
5. Install Encryption Certificate
   1. If there are multiple directories
6. dhparam.pem Setting
7. Other documents

My environment

• jboxberger/synology-gitlab(12.9.2-0055 version)

1. Stop gitlab package

1. Goto to package center
2. Installed tab click
3. Select GitLab
4. Stop click

2. Environment variables setting

1. Run docker package
2. Container tab click
3. select synology_gitlab and edit click
4. Environment tab click
5. Add Environment variables

SSL_KEY_PATH=/home/git/data/certs/gitlab.key
SSL_DHPARAM_PATH=/home/git/data/certs/dhparam.pem
SSL_CERTIFICATES_PATH=/home/git/data/certs/gitlab.crt
SSL_SELF_SIGNED=false
GITLAB_HTTPS=true
GITLAB_HOST=domain.com
GITLAB_PORT=30000(your container port)

3. Port setting

1. Port Settings tab click
2. Change 80 to 433

4. Install Encryption Certificate

1. Open SSH
2. Login
3. Go to /usr/syno/etc/certificate/_archive/

cd /usr/syno/etc/certificate/_archive/

There is a certificate in a directory of six digits directory.

4.4 If there are multiple directories

4.4.1 cd six digits dicrectory

cd xxxxxx

4.4.2 Verify that this is the certificate you want

openssl x509 -text -noout -in fullchain.pem

Certificate:
    Data:
        Version: ...
        Serial Number:
            ...
    Signature Algorithm: ...
        Issuer: ...
        Validity
        ...
        Subject: CN=your.domain.com
        Subject Public Key Info:
        ...

5. Create certs directory

mkdir /volume1/docker/gitlab/gitlab/certs

6. Copy Encryption Certificate

sudo \cp -f privkey.pem /volume1/docker/gitlab/gitlab/certs/gitlab.key;
sudo \cp -f fullchain.pem /volume1/docker/gitlab/gitlab/certs/gitlab.crt;

5. dhparam.pem Setting

Not a must, But I recommend it.

1. Open SSL
2. Login
3. cd /volume1/docker/gitlab/gitlab/certs
4. openssl dhparam -out dhparam.pem 4096
   However, this takes a very long time to NAS, so I recommend you work on your PC.

✔️ Done. good!

Other documents

1. Use reverse proxy
2. Automatic renewal