500 error on oauth call back

[vfilby]

Here is roughly what I did leading up to the error:

1. Fresh docker image setup today using sameersbn/gitlab:8.2.3 (This is going on a QNAP NAS, so I installed via the QNAP utilities).
2. Reset ownership on /var/log/gitlab to make unicorn happy: cd /var/log && chown -R git:git gitlab
3. Root password wouldn't work so I reinitialized the data: sudo -u git -H bundle exec rake gitlab:setup RAILS_ENV=production.
4. Added OAUTH application to github: callback url set to: http://<internal ip address>:10080/
5. Configured ENV variables for the key and secret and confirmed that the github option shows up in the profile and login screen.

When I try to link my gitlab account to github, it redirects successfully to github for auth confirmation, then errors out on the callback with "500 Whoops, something went wrong on our end."

Here is the error from production.log:

Started POST "/users/auth/github" for 127.0.0.1 at 2016-03-04 06:30:12 +0000
Started GET "/users/auth/github/callback?code=[FILTERED]&state=f0c2fc05682585e0b9ddb7405c107dc63d0a482afcfae23c" for 127.0.0.1 at 2016-03-04 06:30:13 +0000

Faraday::ConnectionFailed (getaddrinfo: Name or service not known):
  /usr/lib/ruby/2.1.0/net/http.rb:879:in `initialize'
  /usr/lib/ruby/2.1.0/net/http.rb:879:in `open'
  /usr/lib/ruby/2.1.0/net/http.rb:879:in `block in connect'
  /usr/lib/ruby/2.1.0/timeout.rb:75:in `timeout'
  /usr/lib/ruby/2.1.0/net/http.rb:878:in `connect'
  /usr/lib/ruby/2.1.0/net/http.rb:863:in `do_start'
  /usr/lib/ruby/2.1.0/net/http.rb:852:in `start'
  /usr/lib/ruby/2.1.0/net/http.rb:1375:in `request'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/adapter/net_http.rb:82:in `perform_request'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/adapter/net_http.rb:40:in `block in call'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/adapter/net_http.rb:87:in `with_net_http_connection'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/adapter/net_http.rb:32:in `call'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/request/url_encoded.rb:15:in `call'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/rack_builder.rb:139:in `build_response'
  vendor/bundle/ruby/2.1.0/gems/faraday-0.9.2/lib/faraday/connection.rb:377:in `run_request'
  vendor/bundle/ruby/2.1.0/gems/oauth2-1.0.0/lib/oauth2/client.rb:93:in `request'
  vendor/bundle/ruby/2.1.0/gems/oauth2-1.0.0/lib/oauth2/client.rb:138:in `get_token'
...

An ideas what might be causing the issue or things I could try?

[vfilby]

I tried doing a straight https git import and saw another error, I suspect these are related:

fatal: unable to access 'https://github.com/username/repo.git/': Could not resolve host: github.com

I tried executing a bash shell on the container docker exec -it <id> bash and I was able to ping github.com. I was also able to wget the github.com page.

So I appear to be able to resolver DNS in the container, but there are some networking issues when used through the gitlab UI.

[vfilby]

More interesting, it appears to work fine for root, but not git.

I tried running a git import as root:

root@<dockerid>:/tmp# git clone https://github.com/username/repo.git
Cloning into 'repo'...
remote: Counting objects: 818, done.        
remote: Total 818 (delta 0), reused 0 (delta 0), pack-reused 818        
Receiving objects: 100% (818/818), 123.79 KiB | 0 bytes/s, done.
Resolving deltas: 100% (437/437), done.
Checking connectivity... done.

Here is what happens if I try as git:

git@<dockerid>:/tmp$ git clone https://github.com/username/repo.git
Cloning into 'repo'...
fatal: unable to access 'https://github.com/username/repo.git/': Could not resolve host: github.com

[vfilby]

Looks like this may be related to ACLs:

root@<dockerid>:/sbin# ls -l /etc/resolv.conf 
-rw-r--r--+ 1 root root 40 Mar  5 05:02 /etc/resolv.conf

I haven't played with ACLs before so I would appreciate guidance. The get/setfacl tools are not in my path on the docker image and some googling revealed that I might need to use posix acl type (for cases on ZFS) but I am using ext4 as the underlying filesystem.

[vfilby]

One of the other issues also had acl trouble and was helpful: #544

I added git to the acl for /etc/resolve.conf and was able to link github and import a project.

apt-get update
apt-get install acl
setfacl -m u:git:r /etc/resolv.conf

It seems that other users on QNAP NAS systems have had similar issues.

[sameersbn]

@vfilby the acl settings are already being set on /etc/resolv.conf.

Using ip-address in your oauth callback is probably not a good idea. Can you try using a domain name?

[vfilby]

I checked the acl before adding read permissions for git and it wasn't present. Based on some forums posts I found it looks like there are some basic permission gotchas on the QNAP systems. Worth noting that I recreated the container 3-4 times from scratch and each time had to do the same permissions fixes. Once I even tried running app:sanitize.

Post ACL fix I have no problems with Github integration, though I will be flipping to a DNS entry in the near future.

[vfilby]

A further note for others that find this issue trying to work through permissions. I was having issues with ssh clone.

GitLab: Failed to authorize your Git request: internal API unreachable
fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.

Problem was the permissions on /etc/hosts, resolved by

setfacl -m u:git:r /etc/hosts

[stale]

This issue has been automatically marked as stale because it has not had any activity for the last 60 days. It will be closed if no further activity occurs during the next 7 days. Thank you for your contributions.