Starting with omnibus-gitlab 7.4 there is a built-in logrotate service in omnibus-gitlab.
The proxy itself should be accessed by HTTP and not HTTPS even though the target URL is HTTPS. The proxy will nevertheless properly handle HTTPS connection and keep the end-to-end encryption. See HTTP CONNECT method for details how this is done.