gitlab-ssl-limit-cutgit-anotherstartpage

# GITLAB with SSL with connection limit with requests limit with ".git" cut-off
#   and with "public/projects" as the start page

limit_conn_zone $binary_remote_addr  zone=conn_limit_per_ip:10m;
limit_req_zone  $binary_remote_addr  zone=one:10m   rate=1r/s;

server {
	listen 0.0.0.0:443 ssl;
	root /home/git/gitlab/public;

	ssl on;
	ssl_certificate /etc/nginx/gitlab.crt;
	ssl_certificate_key /etc/nginx/gitlab.key;
	ssl_protocols  SSLv3 TLSv1 TLSv1.2;
	ssl_ciphers AES:HIGH:!ADH:!MD5;
	ssl_prefer_server_ciphers on;
	server_name git.example.com;

	location = /users/sign_in {
		if ($http_referer ~ "^$") {
			rewrite ^ https://git.example.com/public/projects redirect;
		}
		try_files maintenance.html $uri $uri/index.html $uri.htm @gitlab;
	}

	location ~ ^/([^/]*/[^/]*)\.git {
		try_files maintenance.html $uri $uri/index.html $uri.htm @gitlab;
	}

	location ~ ^/([^/]+/[^/]+)/(.*) {
		rewrite ^/([^/]+/[^/]+)/info/(.*)       /$1.git/info/$2         last;
		rewrite ^/([^/]+/[^/]+)/git-(.*)        /$1.git/git-$2          last;
		try_files maintenance.html $uri $uri/index.html $uri.htm @gitlab;
	}

	location ~ /$ {
		limit_req zone=one burst=15 nodelay;
		try_files maintenance.html $uri $uri/index.html $uri.htm @gitlab;
	}

	location / {
		try_files maintenance.html $uri $uri/index.html $uri.htm @gitlab;
	}

	location @gitlab {
		limit_conn conn_limit_per_ip 20;
		proxy_pass http://127.0.0.1:3000;
		proxy_set_header Host                           $host;
		proxy_set_header X-Real-IP                      $remote_addr;
		proxy_set_header X-Forwarded-For                $proxy_add_x_forwarded_for;
		proxy_set_header Referer                        $scheme://$host$request_uri;
		client_max_body_size 256M;
		proxy_redirect off;

		proxy_read_timeout    300; # https://github.com/gitlabhq/gitlabhq/issues/694
		proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
		proxy_redirect        off;

		proxy_set_header  X-Forwarded-Proto https;
		proxy_set_header  X-Forwarded-Ssl   on;
	}
}

server {
	listen *:80 default;
	location / {
		rewrite ^ https://git.example.com$request_uri? permanent;
	}
}