CentOS 上优化 GitLab 网络设置的实用方案
一 基础网络与防火墙
sudo firewall-cmd --permanent --zone=public --add-service=http --add-service=https --add-service=sshsudo firewall-cmd --reload/etc/gitlab/gitlab.rb 正确设置外部访问地址:external_url 'https://your_domain_or_ip',然后执行 sudo gitlab-ctl reconfigure 使配置生效。二 TCP 内核参数优化
/etc/sysctl.conf 或新建 /etc/sysctl.d/99-gitlab-network.conf:
net.core.somaxconn = 65535(增大监听队列)net.ipv4.ip_local_port_range = 1024 65535(扩大本地端口池)net.ipv4.tcp_tw_reuse = 1(允许复用 TIME_WAIT 套接字)net.ipv4.tcp_fin_timeout = 30(加速释放连接)net.ipv4.tcp_fastopen = 3(启用 TCP Fast Open,需客户端支持)sudo sysctl -p /etc/sysctl.d/99-gitlab-network.conftcp_tw_recycle 等选项支持差异较大,生产环境建议优先使用 tcp_tw_reuse 并充分压测验证。三 Nginx 与并发连接优化
/etc/gitlab/gitlab.rb:
nginx['enable'] = trueexternal_url 'https://your_domain_or_ip'nginx['listen_port'] = 80nginx['listen_https'] = truenginx['ssl_certificate_file'] = "/etc/gitlab/ssl/gitlab.example.com.crt"nginx['ssl_certificate_key_file'] = "/etc/gitlab/ssl/gitlab.example.com.key"nginx['ssl_protocols'] = "TLSv1.2 TLSv1.3"nginx['ssl_ciphers'] = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS"nginx['keepalive_timeout'] = 65nginx['keepalive_requests'] = 1000nginx['proxy_read_timeout'] = 3600nginx['client_max_body_size'] = "1024m"(适配大仓库/附件上传)sudo gitlab-ctl reconfigure四 端口与代理场景优化
/etc/gitlab/gitlab.rb 中设置
nginx['listen_port'] = 8080(示例)nginx['listen_https'] = true 并配置证书路径sudo gitlab-ctl reconfigure 生效X-Forwarded-For/X-Forwarded-Proto 等头。external_url 设为 https://...,并确保代理到后端的协议与端口正确。五 验证与持续监控
https://your_domain 验证证书与页面加载;ss -lntp | grep -E '(:80|:443|:22)' 检查监听;curl -Iv https://your_domain 查看 TLS/HTTP 细节;git ls-remote https://your_domain/your-group/your-repo.git 测试 Git 拉取。/etc/gitlab/gitlab.rb 将日志级别调为 info 或 warn 以减少磁盘写入:gitlab_rails['log_level'] = "info";变更后 sudo gitlab-ctl reconfigure。sudo gitlab-ctl reconfigure,必要时 sudo gitlab-ctl restart;上线前在测试环境充分压测并回滚预案。