This instance will be upgraded to Heptapod 0.31.0 (final) on 2022-05-24 at 14:00 UTC+2 (a few minutes of down time)

Commit 9ff4f5d5 authored by Ash McKenzie's avatar Ash McKenzie
Browse files

Merge branch 'add-pages-access-control' into 'master'

Add support for GitLab Pages access_control

See merge request gitlab-org/gitlab-development-kit!1810
# Pages
This page contains information about developing GitLab Pages inside the GDK. This method allows you test GitLab Pages from deployment to visiting your static site.
For further examples check the [Developing inside the GDK](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/master/doc/development.md#developing-inside-the-gdk)
section of the GitLab Pages documentation.
If you would like to develop Pages *outside* of the GDK, see [Getting started with development](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/master/doc/development.md) in the `gitlab-pages` repository.
......@@ -44,3 +46,29 @@
That is because `/etc/hosts` does not support wildcard hostnames.
An alternative is to use [`dnsmasq`](https://wiki.debian.org/dnsmasq)
to handle wildcard hostnames.
## Enable access control
1. Follow steps 3-6 of [this guide](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/master/doc/development.md#enable-access-control)
to create an OAuth application for GitLab Pages.
1. Add the following to `gdk.yml`
```yaml
gitlab_pages:
access_control: true
auth_client_id: 'YOUR_CLIENT_ID' # replace with OAuth Client ID generated above
auth_client_secret: 'YOUR_CLIENT_SECRET' # replace with OAuth Client Secret generated above
```
1. Reconfigure GDK
```shell
gdk reconfigure
```
1. Restart GDK
```shell
gdk restart
```
......@@ -71,6 +71,9 @@
listen_address: 127.0.0.1:8150
listen_network: tcp
gitlab_pages:
access_control: false
auth_client_id: ''
auth_client_secret: ''
auto_update: true
enabled: true
host: 127.0.0.1.nip.io
......
......@@ -226,6 +226,12 @@
bool(:auto_update) { true }
string(:secret_file) { config.gdk_root.join('gitlab-pages-secret') }
bool(:verbose) { false }
bool(:access_control) { false }
string(:auth_client_id) { '' }
string(:auth_client_secret) { '' }
# random 32-byte string
string(:__auth_secret) { rand(36**32).to_s(36) }
string(:__auth_redirect_uri) { "http://#{config.gitlab_pages.__uri}/auth" }
end
settings :gitlab_k8s_agent do
......
......@@ -1106,6 +1106,28 @@
expect(config.gitlab_pages.__uri.to_s).to eq('127.0.0.1.nip.io:3010')
end
end
describe '#access_control' do
it 'defaults to false' do
expect(config.gitlab_pages.access_control?).to eq(false)
end
context 'when access_control is enabled' do
let(:yaml) do
{
'gitlab_pages' => { 'access_control' => true, 'auth_client_id' => 'client_id', 'auth_client_secret' => 'client_secret' }
}
end
it 'configures auth correctly' do
expect(config.gitlab_pages.access_control?).to eq(true)
expect(config.gitlab_pages.auth_client_id).to eq('client_id')
expect(config.gitlab_pages.auth_client_secret).to eq('client_secret')
expect(config.gitlab_pages.__auth_secret.length).to eq(32)
expect(config.gitlab_pages.__auth_redirect_uri).to eq('http://127.0.0.1.nip.io:3010/auth')
end
end
end
end
describe 'prometheus' do
......
......@@ -4,3 +4,9 @@
pages-domain=<%= config.gitlab_pages.host %>
api-secret-key=<%= config.gitlab_pages.secret_file %>
log-verbose=<%= config.gitlab_pages.verbose %>
<%- if config.gitlab_pages.access_control? -%>
auth-client-id=<%= config.gitlab_pages.auth_client_id %>
auth-client-secret=<%= config.gitlab_pages.auth_client_secret %>
auth-secret=<%= config.gitlab_pages.__auth_secret %>
auth-redirect-uri=<%= config.gitlab_pages.__auth_redirect_uri %>
<%- end -%>
......@@ -302,7 +302,7 @@
## GitLab Pages
pages:
enabled: true
access_control: false
access_control: <%= config.gitlab_pages.access_control? %>
host: <%= config.gitlab_pages.host %>
port: <%= config.gitlab_pages.port %>
https: false # Set to true if you serve the pages with HTTPS
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment