GitLab Docker Compose Nginx SSL Proxy

docker-compose.yml

version: '3.7'
services:
  gitlab:
    container_name: gitlab
    image: 'gitlab/gitlab-ce:16.9.1-ce.0'
    restart: always
    hostname: 'hostname'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://hostname'
        letsencrypt['enabled'] = false
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        nginx['redirect_http_to_https'] = false
        registry_nginx['listen_https'] = false
        registry_nginx['proxy_set_headers'] = {
          "X-Forwarded-Proto" => "https",
          "X-Forwarded-Ssl" => "on"
        }
    ports:
      - '8080:80'
      - '22:22'
    volumes:
      - '/opt/gitlab/config:/etc/gitlab'
      - '/opt/gitlab/logs:/var/log/gitlab'
      - '/opt/gitlab/data:/var/opt/gitlab'
    shm_size: '256m'

  gitlab-runner:
    container_name: gitlab-runner
    image: gitlab/gitlab-runner:ubuntu
    restart: always
    volumes:
      - '/opt/gitlab-runner/data:/home/gitlab_ci_multi_runner/data'
      - '/opt/gitlab-runner/config:/etc/gitlab-runner'
      - '/var/run/docker.sock:/var/run/docker.sock:rw'
    environment:
      - CI_SERVER_URL=https://hostname/ci

nginx.site.conf

server {
	server_name hostname;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/hostname/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/hostname/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    access_log  /var/log/nginx/hostname.access.log;
    error_log   /var/log/nginx/hostname.error.log;
    location / {
      proxy_read_timeout      300;
		  proxy_connect_timeout   300;
      proxy_redirect          off;
      proxy_set_header        Host                $http_host;
      proxy_set_header        X-Real-IP           $remote_addr;
      proxy_set_header        X-Forwarded-For     $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto   https;
      proxy_set_header        X-Frame-Options     SAMEORIGIN;
      proxy_pass http://127.0.0.1:8080;
    }

}
server {
    if ($host = hostname) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


	listen 80;
	server_name hostname;
    return 404; # managed by Certbot


}