On Debian 8.0 I’m trying to have Apache 2.4.10 manage a GitLab CE 7.10 Omnibus installation as a virtual host.

Setting and goal

Apache 2 is already set-up and running several virtual hosts that all look like vhost.example.com.

I want to configure Apache and GitLab so that git.example.com gets handled by Apache to display the GitLab web interface.

To that end I followed the procedure described in https://stackoverflow.com/a/25809733/4352108.

Issue

I’m able GitLab’s main page on git.example.com, but I can’t access any other resource such as CSS or icons. Apache logs show four errors that all look like:

[Sun May 10 20:24:57.146329 2015] [authz_core:error] [pid 4141] [client 1.2.3.4:80] AH01630: client denied by server configuration: /opt/gitlab/embedded/service/gitlab-rails/public/assets/application-TOKEN.css, referer: http://git.example.com/

After searching the web and trying several changes I got stuck here. Does anyone have an idea of how this can be solved?

Configuration files

Additionally here are the “interesting” configuration files that I use:

/etc/apache2/sites-enabled/git.conf:

<VirtualHost git.example.com:80>
    ServerAdmin [email protected]
    DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public
    ServerName git.example.com
    ServerAlias git.example.com

    ProxyPreserveHost On

    <Location /opt/gitlab/embedded/service/gitlab-rails/public>

        Order deny,allow
        Allow from all
        Options FollowSymLinks
        Require all granted

        ProxyPassReverse http://localhost:8080
        ProxyPassReverse http://git.example.com
    </Location>

    RewriteEngine on
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
    RewriteRule .* http://localhost:8080%{REQUEST_URI} [P,QSA]

    ErrorDocument 404 /404.html
    ErrorDocument 422 /422.html
    ErrorDocument 500 /500.html
    ErrorDocument 503 /deploy.html

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
    ErrorLog  /${APACHE_LOG_DIR}/gitlab.error.log
    CustomLog /${APACHE_LOG_DIR}/gitlab.forwarded.log common_forwarded
    CustomLog /${APACHE_LOG_DIR}/gitlab.access.log combined env=!dontlog
    CustomLog /${APACHE_LOG_DIR}/gitlab.log combined
</VirtualHost>

/etc/gitlab/gitlab.rb:

external_url 'http://git.example.com'
web_server['external_users'] = ['http']
nginx['enable'] = false

Some interesting enabled Apache mods:

proxy
proxy_http

This worked for me:

<VirtualHost *:80>
  ServerName git.example.com
  ServerSignature Off
  DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public
  ProxyPreserveHost On

  <Location />
    Require all granted
    ProxyPassReverse http://127.0.0.1:8080
    ProxyPassReverse http://git.example.com/
  </Location>

  RewriteEngine on
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
  RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]

  # needed for downloading attachments
  DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

</VirtualHost>

and try to change users from http to www-data