Установка собственного репозитория на примере BitBucket

# yum install epel-release mc net-tools

# useradd supp

# passwd supp

PermitRootLogin no
AllowUsers supp

# systemctl restart sshd

root      ALL=(ALL)       ALL
supp      ALL=(ALL)       ALL

$ wget https://centos7.iuscommunity.org/ius-release.rpm
$ sudo rpm -i ./ius-release.rpm
$ sudo yum update
$ sudo yum install git2u.x86_64

$ wget https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.19.1.tar.gz
$ wget https://mirrors.edge.kernel.org/pub/software/scm/git/git-manpages-2.19.1.tar.gz
$ tar -xzf ./git-2.19.1.tar.gz
$ cd ./git-2.19.1
$ sudo yum -y install autoconf gcc zlib-devel.x86_64 asciidoc xmlto curl-devel
$ make configure
$ ./configure --prefix=/usr 
$ make all doc 
# sudo make install install-doc install-html

$ git --version
git version 2.19.1

$ sudo yum -y install https://download.postgresql.org/pub/repos/yum/10/redhat/rhel-7-x86_64/pgdg-centos10-10-2.noarch.rpm
$ sudo yum -y install postgresql10 postgresql10-server
$ sudo /usr/pgsql-10/bin/postgresql-10-setup initdb
$ sudo systemctl enable postgresql-10
$ sudo systemctl start postgresql-10

host bitbucket bitbucketuser 127.0.0.1/32 md5

$ sudo su
# su postgres
$ psql
postgres=# CREATE ROLE bitbucketuser WITH LOGIN PASSWORD 'UserPass' VALID UNTIL 'infinity';
postgres=# CREATE DATABASE bitbucket WITH ENCODING='UTF8' OWNER=bitbucketuser CONNECTION LIMIT=-1;
postgres=# \q

$ /usr/pgsql-10/bin/pg_ctl restart -D /var/lib/pgsql/10/data/

$ wget https://www.atlassian.com/software/stash/downloads/binary/atlassian-bitbucket-5.15.0-x64.bin

$ chmod a+x ./atlassian-bitbucket-5.15.0-x64.bin

$ sudo ./atlassian-bitbucket-5.15.0-x64.bin

---------------
Unpacking JRE ...
Starting Installer ...
 
Bitbucket 5.15.0 installation wizard
 
Would you like to install or upgrade an instance?
Install a new instance [1, Enter], Upgrade an existing instance [2]
 
Install Bitbucket 5.15.0
What type of instance are you looking to install?
Install a Server instance [1, Enter], Install a Data Center instance [2], Install a Smart Mirroring instance [3]
 
Where should Bitbucket be installed?
 
Select the folder where you would like Bitbucket 5.15.0 to be installed, then click Next.
[/opt/atlassian/bitbucket/5.15.0]
/home/bitbucket
Default location for Bitbucket home directory
 
The location for Bitbucket data.
This will be the default location for repositories, plugins, and other data.
 
Ensure that this location is not used by another Bitbucket installation.
[/var/atlassian/application-data/bitbucket]
/home/bitbucketapp
Configure which ports Bitbucket will use.
 
Configure TCP Ports
Bitbucket requires a TCP port that isn't being used by other applications.
The HTTP port is where users access Bitbucket through their browsers.
 
Bitbucket also requires ports 7992 and 7993 are available to run an embedded
Elasticsearch instance that provides search functionality to Bitbucket.
HTTP Port Number
[7990]
 
Run as a service
For a production server we recommend that you run Bitbucket as a Windows/Linux service because Bitbucket will restart automatically when the computer restarts.
Install Bitbucket as a service?
Yes [y, Enter], No [n]
 
Please review your Bitbucket installation settings
 
Installation Summary
Installation Directory: /home/bitbucket
Home Directory: /home/bitbucketapp
HTTP Port: 7990
Install as a service: Yes
 
Install [i, Enter], Exit [e]
 
Extracting files ...
 
Installation of Bitbucket is complete
Would you like to launch Bitbucket?
Yes [y, Enter], No [n]
 
Please wait a few moments while Bitbucket starts up.
Launching Bitbucket ...
 
Installation of Bitbucket 5.15.0 is complete
Your installation of Bitbucket 5.15.0 is now ready and can be accessed via your browser.
Bitbucket 5.15.0 can be accessed at http://localhost:7990
Launch Bitbucket 5.15.0 in browser?
Yes [y, Enter], No [n]
 
Finishing installation ...

$ sudo firewall-cmd --permanent --new-service=bitbucket-www
$ sudo firewall-cmd --permanent --service=bitbucket-www --set-description="Bitbucket is more than just Git code management. Bitbucket gives teams one place to plan projects, collaborate on code, test, and deploy. Service make a access via www."
$ sudo firewall-cmd --permanent --service=bitbucket-www --set-short="Bitbucket www access"
$ sudo firewall-cmd --permanent --service=bitbucket-www --add-port=7990/tcp
$ sudo firewall-cmd --permanent --zone=public --add-service=bitbucket-www

$ sudo firewall-cmd --permanent --new-service=bitbucket-ssh
$ sudo firewall-cmd --permanent --service=bitbucket-ssh --set-description="Bitbucket is more than just Git code management. Bitbucket gives teams one place to plan projects, collaborate on code, test, and deploy. Service make a access via ssh."
$ sudo firewall-cmd --permanent --service=bitbucket-ssh --set-short="Bitbucket ssh access"
$ sudo firewall-cmd --permanent --service=bitbucket-ssh --add-port=7999/tcp
$ sudo firewall-cmd --permanent --zone=public --add-service=bitbucket-ssh

$ sudo firewall-cmd --reload

$ sudo firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh bitbucket-www bitbucket-ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

$ sudo firewall-cmd --permanent --zone=public --add-port=7990/tcp
$ sudo firewall-cmd --permanent --zone=public --add-port=7999/tcp
$ sudo firewall-cmd --reload

$ sudo yum -y iptables-services
$ sudo systemctl stop firewalld
$ sudo systemctl disable firewalld
$ sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ sudo iptables -A INPUT -s 0.0.0.0/0 -p TCP --dport 7990 -j ACCEPT
$ sudo iptables -A INPUT -s 0.0.0.0/0 -p TCP --dport 7999 -j ACCEPT
$ sudo iptables -A INPUT -s 0.0.0.0/0 -p TCP --dport 22 -j ACCEPT
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP

$ sudo iptables -I INPUT num_line -s 0.0.0.0/0 -p TCP --dport 7999 -j ACCEPT
$ sudo iptables -I INPUT num_line -s 0.0.0.0/0 -p TCP --dport 7990 -j ACCEPT
$ sudo iptables-save > /etc/sysconfig/iptables

$ sudo iptables -L -n -v

$ sudo yum -y install yum-utils nginx
$ sudo yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
$ sudo yum -y install python2-certbot-nginx
$ sudo systemctl enable nginx
$ sudo systemctl start nginx

$ sudo firewall-cmd --permanent --zone=public --add-service=http
$ sudo firewall-cmd --permanent --zone=public --add-service=https
$ sudo firewall-cmd --reload

$ sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
$ sudo firewall-cmd --permanent --zone=public --add-port=443/tcp

$ sudo iptables -A INPUT -s 0.0.0.0/0 -p TCP --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -s 0.0.0.0/0 -p TCP --dport 443 -j ACCEPT
$ sudo iptables-save > /etc/sysconfig/iptables

$ sudo certbot --nginx -d your_domain
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): your_email
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. 
You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Starting new HTTPS connection (1): supporters.eff.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for your_domain
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/nginx.conf
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Redirecting all traffic on port 80 to ssl in /etc/nginx/nginx.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://your_domain
You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/your_domain/fullchain.pem
Your key file has been saved at: /etc/letsencrypt/live/your_domain/privkey.pem
Your cert will expire on 2019-01-25. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew"
Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal.
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate 
Donating to EFF: https://eff.org/donate-le

$ sudo crontab -e

0 0 * * * /usr/bin/certbot renew

$ sudo crontab -l
0 0 * * * /usr/bin/certbot renew

#behind proxy NGINX
server.port=7990
server.secure=true
server.scheme=https
server.proxy-port=443
server.proxy-name=your_domain
server.context-path=/

$ sudo service atlbitbucket stop
$ sudo service atlbitbucket start

location / {
            proxy_pass          http://localhost:7990;
            proxy_set_header    X-Forwarded-Host $host;
            proxy_set_header    X-Forwarded-Server $host;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header    X-Real-IP $remote_addr;
            proxy_redirect      off;
        }

$ sudo nginx -s reload

$ sudo firewall-cmd --permanent --zone=public --remove-service=bitbucket-www
$ sudo firewall-cmd --reload

$ sudo iptables -L -n -v --line-numbers
$ sudo iptables -D INPUT number_line
$ sudo iptables-save > /etc/sysconfig/iptables

$ sudo service atlbitbucket status 
$ sudo service atlbitbucket stop 
$ sudo service atlbitbucket start

$ sudo /home/bitbucket/bin/stop-bitbucket.sh 
$ sudo /home/bitbucket/bin/start-bitbucket.sh 

$ sudo /home/bitbucket/bin/start-bitbucket.sh --no-search