ssl - 故障排除 - 设置私有(private) GitLab 服务器并连接 Gitlab Runners

Question

我有一个在专用私有(private)服务器上的 docker 中运行的 Gitlab 实例(只能从我们的 vpc 中访问)。我们想开始使用 Gitlab 运行器进行 CI，所以我启动了另一台服务器来托管我们的运行器。
现在已经配置了 Gitlab-Runner，我尝试使用 Gitlab 服务器的私有(private) IP 和注册 token 注册一个运行器

Enter the GitLab instance URL (for example, https://gitlab.com/):
$GITLAB_PRIVATE_IP
Enter the registration token:
$TOKEN
Enter a description for the runner:
[BEG-GITLAB-RUNNER]: default
Enter tags for the runner (comma-separated):
default
ERROR: Registering runner... failed                 runner=m616FJy- status=couldn't execute POST against https://$GITLAB_PRIVATE_IP/api/v4/runners: Post "https://$GITLAB_PRIVATE_IP/api/v4/runners": x509: certificate has expired or is not yet valid: current time 2022-02-06T20:00:35Z is after 2021-12-24T04:54:28Z

看起来我们的证书已过期并验证:

echo | openssl s_client -showcerts -connect $GITLAB_PRIVATE_IP:443 2>&1 | openssl x509 -noout -dates
notBefore=Nov 24 04:54:28 2021 GMT
notAfter=Dec 24 04:54:28 2021 GMT

Gitlab 带有 let's encrypt，所以我决定在 gitlab rails 中启用 let's encrypt 和 cert autorenewal，但是当我尝试重新配置时，我收到错误消息:

There was an error running gitlab-ctl reconfigure:

letsencrypt_certificate[$GITLAB_PRIVATE_IP] (letsencrypt::http_authorization line 6) had an error: Acme::Client::Error::RejectedIdentifier: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 41) had an error: Acme::Client::Error::RejectedIdentifier: Error creating new order :: Cannot issue for "$GITLAB_PRIVATE_IP": The ACME server can not issue a certificate for an IP address

所以看起来我不能使用与 gitlab 一起打包的 let's encrypt 选项来启用证书的更新。
如何在没有域的私有(private) linux 服务器上创建/更新 ssl 证书？
如果你在私有(private)服务器上设置了 Gitlab + Runners，你的 rails 配置是什么样的？
有没有办法仅出于授予证书的证书颁发机构的目的而在私有(private)服务器上启用 DNS？

Answer 1

我建议使用我之前测试过的自签名证书，它工作正常，但需要一些工作。我将尝试总结一些所需的步骤:

1- generate Self-signed certificate with the domain you choose and make sure to keep it in /etc/gitlab-runner/certs/
2- you need to add the domain and certs path in /etc/gitlab/gitlab.rb
3- reconfigure giltab
4- when connecting the runner make sure to manually copy and activate certs to the runner server .