The option hostname: gitlab.example.com adds the /etc/hosts record 172.xx.0.x gitlab.example.com so all requests go internally bypass the reverse proxy. It’s fine for http, but when it comes to https, you are getting https://gitlab.example./oauth/token: dial tcp 172.xx.0.x:443: getsockopt: connection refused`
I kept hostname option and specified http urls in gitlab endpoints. My config:
external_url 'https://gitlab.example.com'
nginx['listen_port'] = 80
nginx['listen_https'] = false
mattermost_external_url 'https://mattermost.example.com'
mattermost_nginx['listen_port'] = 80
mattermost_nginx['listen_https'] = false
mattermost['gitlab_auth_endpoint'] = "http://gitlab.example.com/oauth/authorize"
mattermost['gitlab_token_endpoint'] = "http://gitlab.example.com/oauth/token"
mattermost['gitlab_user_api_endpoint'] = "http://gitlab.example.com/api/v4/user"