sameersbn / sameersbn/docker-gitlab
Critical. 403 forbidden error
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 8.1k
- Forks
- 2.1k
- Avg merge
- 17h 47m
- Merged PRs (30d)
- 7
Description
Hi guys. I am facing frequent 403 forbidden issue for git cloning, runner's cloning, and curl requests to gitlab frontent port.
Running gitlab from sameersbn docker-compose.yml file with version 12.5.2.
Gitlab site works fine on browser.
ssh cloning is working fine.
Other API requests are working fine.
Git clone with https method gives 403 forbidden error.
Since gitlab runners also clone with https only by default, that gives same error.
I am running gitlab site on AWS machine with ubuntu server edition.
I have tried curl request directly in server in following ways -
Scenario 1
curl localhost:8000 (8000 is published port for http)
Forbidden
curl 10.0.0.114:8000
Works fine. Gives below output
<html><body>You are being <a href="https://10.0.0.114:8000/users/sign_in">redirected</a>.</body></html>
curl 172.20.0.4:80 (container ip and port of gitlab)
<html><body>You are being <a href="https://172.20.0.4:80/users/sign_in">redirected</a>.</body></html>
Now sometimes both (server's private ip and localhost) gives forbidden error. Followed by container ip curl request error forbidden.
Scenario 2
curl localhost:8000 (8000 is published port for http)
Forbidden
curl 10.0.0.114:8000
forbidden
curl 172.20.0.4:80 (container ip and port of gitlab)
forbidden
Infra configuration
- AWS EC2 t3.large.
- Public VPC and subnet.
- Security group has inbound access for http and ssh properly
- Gitlab running as docker-compose.
- Web server Nginx as daemon service for ssl and domain mapping.
- Elastic IP for Public ip persistance.
None of the above is giving permanent solution.
Following suspected behaviour -
- Docker network is giving issue somewhere
- Postgresql database is giving issue.
Following solution we have tried -
- Changing docker-compose network range.
- Starting fresh gitlab on new aws server and using same volume data from original gitlab server.
- Tried different subnets in aws VPC for the server.
- When scenario 1 happens, I do workaround fix by pointing my nginx to private ip of server from localhost.
Please help...
Let me know if any follow up questions are there to get more details.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the 403 with the listed curl requests against localhost:8000, the private address, and the GitLab container address, then compare those paths with HTTPS Git cloning and runner cloning. Review the docker-compose networking and Nginx SSL/domain mapping described in the issue; done means these requests and HTTPS clones work consistently without 403 responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, git, nginx
- Domain
- devops, infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100