gitlab.yml.example 28.1 KB
Newer Older
1
# # # # # # # # # # # # # # # # # #
2
# GitLab application config file  #
3
# # # # # # # # # # # # # # # # # #
4
#
5
6
###########################  NOTE  #####################################
# This file should not receive new settings. All configuration options #
7
# * are being moved to ApplicationSetting model!                       #
8
# If a setting requires an application restart say so in that screen.  #
9
10
# If you change this file in a Merge Request, please also create       #
# a MR on https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests  #
11
12
########################################################################
#
13
#
14
# How to use:
Ben Bodenmiller's avatar
Ben Bodenmiller committed
15
16
# 1. Copy file as gitlab.yml
# 2. Update gitlab -> host with your fully qualified domain name
17
# 3. Update gitlab -> email_from
Ben Bodenmiller's avatar
Ben Bodenmiller committed
18
# 4. If you installed Git from source, change git -> bin_path to /usr/local/bin/git
19
20
21
#    IMPORTANT: If Git was installed in a different location use that instead.
#    You can check with `which git`. If a wrong path of Git is specified, it will
#     result in various issues such as failures of GitLab CI builds.
Ben Bodenmiller's avatar
Ben Bodenmiller committed
22
# 5. Review this configuration file for other settings you may want to adjust
23

24
25
26
27
production: &base
  #
  # 1. GitLab app settings
  # ==========================
randx's avatar
randx committed
28

29
30
  ## GitLab settings
  gitlab:
31
    ## Web server settings (note: host is the FQDN, do not include http://)
32
    host: localhost
Ben Bodenmiller's avatar
Ben Bodenmiller committed
33
34
    port: 80 # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
    https: false # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
35

36
37
38
39
40
    # Uncommment this line below if your ssh host is different from HTTP/HTTPS one
    # (you'd obviously need to replace ssh.host_example.com with your own host).
    # Otherwise, ssh host will be set to the `host:` value above
    # ssh_host: ssh.host_example.com

41
    # Relative URL support
Achilleas Pipinellis's avatar
Achilleas Pipinellis committed
42
43
    # WARNING: We recommend using an FQDN to host GitLab in a root path instead
    # of using a relative URL.
44
45
46
    # Documentation: http://doc.gitlab.com/ce/install/relative_url.html
    # Uncomment and customize the following line to run in a non-root path
    #
47
    # relative_url_root: /gitlab
48

49
50
51
52
53
54
55
56
57
    # Trusted Proxies
    # Customize if you have GitLab behind a reverse proxy which is running on a different machine.
    # Add the IP address for your reverse proxy to the list, otherwise users will appear signed in from that address.
    trusted_proxies:
      # Examples:
      #- 192.168.1.0/24
      #- 192.168.2.1
      #- 2001:0db8::/32

58
59
    # Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
    # user: git
Riyad Preukschas's avatar
Riyad Preukschas committed
60

61
62
    ## Date & Time settings
    # Uncomment and customize if you want to change the default time zone of GitLab application.
63
    # To see all available zones, run `bundle exec rake time:zones:all RAILS_ENV=production`
64
65
    # time_zone: 'UTC'

66
67
68
69
70
71
72
    ## Email settings
    # Uncomment and set to false if you need to disable email sending from GitLab (default: true)
    # email_enabled: true
    # Email address used in the "From" field in mails sent by GitLab
    email_from: example@example.com
    email_display_name: GitLab
    email_reply_to: noreply@example.com
Fu Xu's avatar
Fu Xu committed
73
    email_subject_suffix: ''
74
75
76

    # Email server smtp settings are in config/initializers/smtp_settings.rb.sample

77
    # default_can_create_group: false  # default: true
78
    # username_changing_enabled: false # default: true - User can change her username/namespace
Izaak Alpert's avatar
Izaak Alpert committed
79

80
    ## Automatic issue closing
Sytse Sijbrandij's avatar
Sytse Sijbrandij committed
81
    # If a commit message matches this regular expression, all issues referenced from the matched text will be closed.
Julien Kirch's avatar
Julien Kirch committed
82
    # This happens when the commit is pushed or merged into the default branch of a project.
Sytse Sijbrandij's avatar
Sytse Sijbrandij committed
83
    # When not specified the default issue_closing_pattern as specified below will be used.
Achilleas Pipinellis's avatar
Achilleas Pipinellis committed
84
    # Tip: you can test your closing pattern at http://rubular.com.
85
    # issue_closing_pattern: '((?:[Cc]los(?:e[sd]?|ing)|[Ff]ix(?:e[sd]|ing)?|[Rr]esolv(?:e[sd]?|ing))(:?) +(?:(?:issues? +)?%{issue_ref}(?:(?:, *| +and +)?)|([A-Z][A-Z0-9_]+-\d+))+)'
86

87
88
89
90
91
    ## Default project features settings
    default_projects_features:
      issues: true
      merge_requests: true
      wiki: true
92
      snippets: true
93
      builds: true
94
      container_registry: true
95

96
97
98
99
    ## Webhook settings
    # Number of seconds to wait for HTTP response after sending webhook HTTP POST request (default: 10)
    # webhook_timeout: 10

100
101
    ## Repository downloads directory
    # When a user clicks e.g. 'Download zip' on a project, a temporary zip file is created in the following directory.
102
103
    # The default is 'shared/cache/archive/' relative to the root of the Rails app.
    # repository_downloads_path: shared/cache/archive/
104

Douwe Maan's avatar
Douwe Maan committed
105
  ## Reply by email
Douwe Maan's avatar
Douwe Maan committed
106
  # Allow users to comment on issues and merge requests by replying to notification emails.
107
  # For documentation on how to set this up, see http://doc.gitlab.com/ce/administration/reply_by_email.html
108
  incoming_email:
Douwe Maan's avatar
Douwe Maan committed
109
    enabled: false
110
111

    # The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
112
    # The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
    address: "gitlab-incoming+%{key}@gmail.com"

    # Email account username
    # With third party providers, this is usually the full email address.
    # With self-hosted email servers, this is usually the user part of the email address.
    user: "gitlab-incoming@gmail.com"
    # Email account password
    password: "[REDACTED]"

    # IMAP server host
    host: "imap.gmail.com"
    # IMAP server port
    port: 993
    # Whether the IMAP server uses SSL
    ssl: true
    # Whether the IMAP server uses StartTLS
    start_tls: false

    # The mailbox where incoming mail will end up. Usually "inbox".
    mailbox: "inbox"
133
    # The IDLE command timeout.
134
    idle_timeout: 60
Douwe Maan's avatar
Douwe Maan committed
135

Kamil Trzcinski's avatar
Kamil Trzcinski committed
136
137
138
139
140
141
  ## Build Artifacts
  artifacts:
    enabled: true
    # The location where build artifacts are stored (default: shared/artifacts).
    # path: shared/artifacts

Marin Jankovski's avatar
Marin Jankovski committed
142
143
  ## Git LFS
  lfs:
Marin Jankovski's avatar
Marin Jankovski committed
144
    enabled: true
Marin Jankovski's avatar
Marin Jankovski committed
145
146
147
    # The location where LFS objects are stored (default: shared/lfs-objects).
    # storage_path: shared/lfs-objects

Kamil Trzcinski's avatar
Kamil Trzcinski committed
148
149
150
151
152
153
154
155
156
  ## GitLab Pages
  pages:
    enabled: false
    # The location where pages are stored (default: shared/pages).
    # path: shared/pages

    # The domain under which the pages are served:
    # http://group.example.com/project
    # or project path can be a group page: group.example.com
Kamil Trzcinski's avatar
Kamil Trzcinski committed
157
    host: example.com
158
159
    port: 80 # Set to 443 if you serve the pages with HTTPS
    https: false # Set to true if you serve the pages with HTTPS
160
161
    # external_http: ["1.1.1.1:80", "[2001::1]:80"] # If defined, enables custom domain support in GitLab Pages
    # external_https: ["1.1.1.1:443", "[2001::1]:443"] # If defined, enables custom domain and certificate support in GitLab Pages
Kamil Trzcinski's avatar
Kamil Trzcinski committed
162

163
164
165
166
167
168
  ## Mattermost
  ## For enabling Add to Mattermost button
  mattermost:
    enabled: false
    host: 'https://mattermost.example.com'

169
  ## Gravatar
170
  ## For Libravatar see: http://doc.gitlab.com/ce/customization/libravatar.html
171
  gravatar:
172
    # gravatar urls: possible placeholders: %{hash} %{size} %{email} %{username}
173
174
    # plain_url: "http://..."     # default: http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
    # ssl_url:   "https://..."    # default: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
Riyad Preukschas's avatar
Riyad Preukschas committed
175

176
177
178
179
  ## Auxiliary jobs
  # Periodically executed jobs, to self-heal Gitlab, do external synchronizations, etc.
  # Please read here for more information: https://github.com/ondrejbartas/sidekiq-cron#adding-cron-job
  cron_jobs:
180
181
    # Flag stuck CI jobs as failed
    stuck_ci_jobs_worker:
182
      cron: "0 * * * *"
Shinya Maeda's avatar
Shinya Maeda committed
183
    # Execute scheduled triggers
184
    pipeline_schedule_worker:
185
      cron: "19 * * * *"
186
187
    # Remove expired build artifacts
    expire_build_artifacts_worker:
188
      cron: "50 * * * *"
Jacob Vosmaer's avatar
Jacob Vosmaer committed
189
190
    # Periodically run 'git fsck' on all repositories. If started more than
    # once per hour you will have concurrent 'git fsck' jobs.
Jacob Vosmaer's avatar
Jacob Vosmaer committed
191
    repository_check_worker:
Jacob Vosmaer's avatar
Jacob Vosmaer committed
192
      cron: "20 * * * *"
193
    # Send admin emails once a week
Jacob Vosmaer's avatar
Jacob Vosmaer committed
194
    admin_email_worker:
195
      cron: "0 0 * * 0"
196

197
198
199
    # Remove outdated repository archives
    repository_archive_cache_worker:
      cron: "0 * * * *"
200

Kamil Trzcinski's avatar
Kamil Trzcinski committed
201
202
  registry:
    # enabled: true
203
    # host: registry.example.com
204
205
    # port: 5005
    # api_url: http://localhost:5000/ # internal address to the registry, will be used by GitLab to directly communicate with API
206
    # key: config/registry.key
207
    # path: shared/registry
208
    # issuer: gitlab-issuer
Kamil Trzcinski's avatar
Kamil Trzcinski committed
209

210
  #
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
  # 2. GitLab CI settings
  # ==========================

  gitlab_ci:
    # Default project notifications settings:
    #
    # Send emails only on broken builds (default: true)
    # all_broken_builds: true
    #
    # Add pusher to recipients list (default: false)
    # add_pusher: true

    # The location where build traces are stored (default: builds/). Relative paths are relative to Rails.root
    # builds_path: builds/

  #
  # 3. Auth settings
228
  # ==========================
Riyad Preukschas's avatar
Riyad Preukschas committed
229

230
  ## LDAP settings
231
232
  # You can test connections and inspect a sample of the LDAP users with login
  # access by running:
233
  #   bundle exec rake gitlab:ldap:check RAILS_ENV=production
234
235
  ldap:
    enabled: false
236
    servers:
237
238
239
240
241
242
243
244
245
      ##########################################################################
      #
      # Since GitLab 7.4, LDAP servers get ID's (below the ID is 'main'). GitLab
      # Enterprise Edition now supports connecting to multiple LDAP servers.
      #
      # If you are updating from the old (pre-7.4) syntax, you MUST give your
      # old server the ID 'main'.
      #
      ##########################################################################
246
      main: # 'main' is the GitLab 'provider ID' of this LDAP server
247
248
249
250
251
252
253
254
        ## label
        #
        # A human-friendly name for your LDAP server. It is OK to change the label later,
        # for instance if you find out it is too large to fit on the web page.
        #
        # Example: 'Paris' or 'Acme, Ltd.'
        label: 'LDAP'

255
        # Example: 'ldap.mydomain.com'
256
        host: '_your_ldap_server'
257
258
259
260
261
        # This port is an example, it is sometimes different but it is always an integer and not a string
        port: 389 # usually 636 for SSL
        uid: 'sAMAccountName' # This should be the attribute, not the value that maps to uid.

        # Examples: 'america\\momo' or 'CN=Gitlab Git,CN=Users,DC=mydomain,DC=com'
262
263
        bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
        password: '_the_password_of_the_bind_user'
264

Michael Kozono's avatar
Michael Kozono committed
265
266
267
268
269
270
271
272
273
274
275
        # Encryption method. The "method" key is deprecated in favor of
        # "encryption".
        #
        #   Examples: "start_tls" or "simple_tls" or "plain"
        #
        #   Deprecated values: "tls" was replaced with "start_tls" and "ssl" was
        #   replaced with "simple_tls".
        #
        encryption: 'plain'

        # Enables SSL certificate verification if encryption method is
276
277
        # "start_tls" or "simple_tls". Defaults to true.
        verify_certificates: true
Michael Kozono's avatar
Michael Kozono committed
278
279
280
281
282
283

        # Specifies the path to a file containing a PEM-format CA certificate,
        # e.g. if you need to use an internal CA.
        #
        #   Example: '/etc/ca.pem'
        #
284
        ca_file: ''
Michael Kozono's avatar
Michael Kozono committed
285
286
287
288
289
290
291
292

        # Specifies the SSL version for OpenSSL to use, if the OpenSSL default
        # is not appropriate.
        #
        #   Example: 'TLSv1_1'
        #
        ssl_version: ''

293
294
295
296
297
        # Set a timeout, in seconds, for LDAP queries. This helps avoid blocking
        # a request if the LDAP server becomes unresponsive.
        # A value of 0 means there is no timeout.
        timeout: 10

298
299
300
301
        # This setting specifies if LDAP server is Active Directory LDAP server.
        # For non AD servers it skips the AD specific queries.
        # If your LDAP server is not AD, set this to false.
        active_directory: true
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
302

303
304
305
306
307
308
309
310
311
312
        # If allow_username_or_email_login is enabled, GitLab will ignore everything
        # after the first '@' in the LDAP username submitted by the user on login.
        #
        # Example:
        # - the user enters 'jane.doe@example.com' and 'p@ssw0rd' as LDAP credentials;
        # - GitLab queries the LDAP server with 'jane.doe' and 'p@ssw0rd'.
        #
        # If you are using "uid: 'userPrincipalName'" on ActiveDirectory you need to
        # disable this setting, because the userPrincipalName contains an '@'.
        allow_username_or_email_login: false
313

314
        # To maintain tight control over the number of active users on your GitLab installation,
315
        # enable this setting to keep new users blocked until they have been cleared by the admin
316
        # (default: false).
317
318
        block_auto_created_users: false

319
320
        # Base where we can search for users
        #
321
        #   Ex. 'ou=People,dc=gitlab,dc=example' or 'DC=mydomain,DC=com'
322
323
        #
        base: ''
324

325
326
        # Filter LDAP users
        #
327
        #   Format: RFC 4515 https://tools.ietf.org/search/rfc4515
328
329
330
331
        #   Ex. (employeeType=developer)
        #
        #   Note: GitLab does not support omniauth-ldap's custom filter syntax.
        #
332
333
334
        #   Example for getting only specific users:
        #   '(&(objectclass=user)(|(samaccountname=momo)(samaccountname=toto)))'
        #
335
        user_filter: ''
336

Douwe Maan's avatar
Douwe Maan committed
337
        # LDAP attributes that GitLab will use to create an account for the LDAP user.
Douwe Maan's avatar
Douwe Maan committed
338
339
        # The specified attribute can either be the attribute name as a string (e.g. 'mail'),
        # or an array of attribute names to try in order (e.g. ['mail', 'email']).
Douwe Maan's avatar
Douwe Maan committed
340
341
342
343
344
        # Note that the user's LDAP login will always be the attribute specified as `uid` above.
        attributes:
          # The username will be used in paths for the user's own projects
          # (like `gitlab.example.com/username/project`) and when mentioning
          # them in issues, merge request and comments (like `@username`).
345
          # If the attribute specified for `username` contains an email address,
Douwe Maan's avatar
Douwe Maan committed
346
347
348
349
350
          # the GitLab username will be the part of the email address before the '@'.
          username: ['uid', 'userid', 'sAMAccountName']
          email:    ['mail', 'email', 'userPrincipalName']

          # If no full name could be found at the attribute specified for `name`,
351
          # the full name is determined using the attributes specified for
Douwe Maan's avatar
Douwe Maan committed
352
353
354
355
356
          # `first_name` and `last_name`.
          name:       'cn'
          first_name: 'givenName'
          last_name:  'sn'

357
358
359
360
361
362
363
364
365
      # GitLab EE only: add more LDAP servers
      # Choose an ID made of a-z and 0-9 . This ID will be stored in the database
      # so that GitLab can remember which LDAP server a user belongs to.
      # uswest2:
      #   label:
      #   host:
      #   ....


366
  ## OmniAuth settings
367
  omniauth:
368
    # Allow login via Twitter, Google, etc. using OmniAuth providers
369
    enabled: false
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
370

371
372
373
374
    # Uncomment this to automatically sign in with a specific omniauth provider's without
    # showing GitLab's sign-in page (default: show the GitLab sign-in page)
    # auto_sign_in_with_provider: saml

375
376
377
378
    # Sync user's email address from the specified Omniauth provider every time the user logs
    # in (default: nil). And consequently make this field read-only.
    # sync_email_from_provider: cas3

379
    # CAUTION!
380
381
    # This allows users to login without having a user account first. Define the allowed providers
    # using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
382
    # User accounts will be created automatically when authentication was successful.
383
384
    allow_single_sign_on: ["saml"]

385
    # Locks down those users until they have been cleared by the admin (default: true).
386
    block_auto_created_users: true
387
388
389
    # Look up new users in LDAP servers. If a match is found (same uid), automatically
    # link the omniauth identity with the LDAP account. (default: false)
    auto_link_ldap_user: false
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
390

391
392
393
394
395
    # Allow users with existing accounts to login and auto link their account via SAML
    # login, without having to do a manual login first and manually add SAML
    # (default: false)
    auto_link_saml_user: false

Patricio Cano's avatar
Patricio Cano committed
396
397
398
399
400
401
402
    # Set different Omniauth providers as external so that all users creating accounts
    # via these providers will not be able to have access to internal projects. You
    # will need to use the full name of the provider, like `google_oauth2` for Google.
    # Refer to the examples below for the full names of the supported providers.
    # (default: [])
    external_providers: []

403
    ## Auth providers
404
405
    # Uncomment the following lines and fill in the data of the auth provider you want to use
    # If your favorite auth provider is not listed you can use others:
Drew Blessing's avatar
Drew Blessing committed
406
    # see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations
407
408
    # The 'app_id' and 'app_secret' parameters are always passed as the first two
    # arguments, followed by optional 'args' which can be either a hash or an array.
dosire's avatar
dosire committed
409
    # Documentation for this is available at http://doc.gitlab.com/ce/integration/omniauth.html
410
    providers:
tduehr's avatar
tduehr committed
411
412
413
414
415
416
417
418
419
      # See omniauth-cas3 for more configuration details
      # - { name: 'cas3',
      #     label: 'cas3',
      #     args: {
      #             url: 'https://sso.example.com',
      #             disable_ssl_verification: false,
      #             login_url: '/cas/login',
      #             service_validate_url: '/cas/p3/serviceValidate',
      #             logout_url: '/cas/logout'} }
420
      # - { name: 'authentiq',
421
      #     # for client credentials (client ID and secret), go to https://www.authentiq.com/developers
422
423
424
425
      #     app_id: 'YOUR_CLIENT_ID',
      #     app_secret: 'YOUR_CLIENT_SECRET',
      #     args: {
      #             scope: 'aq:name email~rs address aq:push'
426
427
      #             # callback_url parameter is optional except when 'gitlab.host' in this file is set to 'localhost'
      #             # callback_url: 'YOUR_CALLBACK_URL'
428
429
      #           }
      #   }
Douwe Maan's avatar
Douwe Maan committed
430
431
432
      # - { name: 'github',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET',
433
434
      #     url: "https://github.com/",
      #     verify_ssl: true,
Douwe Maan's avatar
Douwe Maan committed
435
436
437
438
439
440
441
442
      #     args: { scope: 'user:email' } }
      # - { name: 'bitbucket',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET' }
      # - { name: 'gitlab',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET',
      #     args: { scope: 'api' } }
443
444
      # - { name: 'google_oauth2',
      #     app_id: 'YOUR_APP_ID',
Douwe Maan's avatar
Douwe Maan committed
445
      #     app_secret: 'YOUR_APP_SECRET',
446
      #     args: { access_type: 'offline', approval_prompt: '' } }
Douwe Maan's avatar
Douwe Maan committed
447
448
449
      # - { name: 'facebook',
      #     app_id: 'YOUR_APP_ID',
      #     app_secret: 'YOUR_APP_SECRET' }
450
451
      # - { name: 'twitter',
      #     app_id: 'YOUR_APP_ID',
452
      #     app_secret: 'YOUR_APP_SECRET' }
Douwe Maan's avatar
Douwe Maan committed
453
      #
Alex Lossent's avatar
Alex Lossent committed
454
      # - { name: 'saml',
455
      #     label: 'Our SAML Provider',
Patricio Cano's avatar
Patricio Cano committed
456
457
      #     groups_attribute: 'Groups',
      #     external_groups: ['Contractors', 'Freelancers'],
Alex Lossent's avatar
Alex Lossent committed
458
459
460
461
462
463
464
      #     args: {
      #             assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
      #             idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
      #             idp_sso_target_url: 'https://login.example.com/idp',
      #             issuer: 'https://gitlab.example.com',
      #             name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
      #           } }
Patricio Cano's avatar
Patricio Cano committed
465
      #
Valery Sizov's avatar
Valery Sizov committed
466
467
468
469
470
      # - { name: 'crowd',
      #     args: {
      #       crowd_server_url: 'CROWD SERVER URL',
      #       application_name: 'YOUR_APP_NAME',
      #       application_password: 'YOUR_APP_PASSWORD' } }
471
472
473
474
475
476
      #
      # - { name: 'auth0',
      #     args: {
      #       client_id: 'YOUR_AUTH0_CLIENT_ID',
      #       client_secret: 'YOUR_AUTH0_CLIENT_SECRET',
      #       namespace: 'YOUR_AUTH0_DOMAIN' } }
Alex Lossent's avatar
Alex Lossent committed
477

tduehr's avatar
tduehr committed
478
479
480
481
    # SSO maximum session duration in seconds. Defaults to CAS default of 8 hours.
    # cas3:
    #   session_duration: 28800

482
483
484
485
  # Shared file storage settings
  shared:
    # path: /mnt/gitlab # Default: shared

486
487
  # Gitaly settings
  gitaly:
Jacob Vosmaer's avatar
Jacob Vosmaer committed
488
489
490
491
    # Default Gitaly authentication token. Can be overriden per storage. Can
    # be left blank when Gitaly is running locally on a Unix socket, which
    # is the normal way to deploy Gitaly.
    token:
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
492

493
  #
494
  # 4. Advanced settings
495
496
  # ==========================

497
498
499
  ## Repositories settings
  repositories:
    # Paths where repositories can be stored. Give the canonicalized absolute pathname.
Elan Ruusamäe's avatar
Elan Ruusamäe committed
500
501
502
    # IMPORTANT: None of the path components may be symlink, because
    # gitlab-shell invokes Dir.pwd inside the repository path and that results
    # real path not the symlink.
503
    storages: # You must have at least a `default` storage path.
504
505
      default:
        path: /home/git/repositories/
506
        gitaly_address: unix:/home/git/gitlab/tmp/sockets/private/gitaly.socket # TCP connections are supported too (e.g. tcp://host:port)
507
        # gitaly_token: 'special token' # Optional: override global gitaly.token for this storage.
508
509
510
        failure_count_threshold: 10 # number of failures before stopping attempts
        failure_wait_time: 30 # Seconds after an access failure before allowing access again
        failure_reset_time: 1800 # Time in seconds to expire failures
511
        storage_timeout: 30 # Time in seconds to wait before aborting a storage access attempt
512

513

514
515
516
  ## Backup settings
  backup:
    path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
517
    # archive_permissions: 0640 # Permissions for the resulting backup.tar file (default: 0600)
518
    # keep_time: 604800   # default: 0 (forever) (in seconds)
Valery Sizov's avatar
Valery Sizov committed
519
    # pg_schema: public     # default: nil, it means that all schemas will be backed up
520
521
522
523
    # upload:
    #   # Fog storage connection settings, see http://fog.io/storage/ .
    #   connection:
    #     provider: AWS
524
    #     region: eu-west-1
525
526
527
528
    #     aws_access_key_id: AKIAKIAKI
    #     aws_secret_access_key: 'secret123'
    #   # The remote 'directory' to store your backups. For S3, this would be the bucket name.
    #   remote_directory: 'my.s3.bucket'
529
530
531
    #   # Use multipart uploads when file size reaches 100MB, see
    #   #  http://docs.aws.amazon.com/AmazonS3/latest/dev/uploadobjusingmpu.html
    #   multipart_chunk_size: 104857600
532
533
    #   # Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
    #   # encryption: 'AES256'
534
535
    #   # Specifies Amazon S3 storage class to use for backups, this is optional
    #   # storage_class: 'STANDARD'
536

537
538
  ## GitLab Shell settings
  gitlab_shell:
539
    path: /home/git/gitlab-shell/
540
    hooks_path: /home/git/gitlab-shell/hooks/
Riyad Preukschas's avatar
Riyad Preukschas committed
541

542
543
544
545
    # File that contains the secret key for verifying access for gitlab-shell.
    # Default is '.gitlab_shell_secret' relative to Rails.root (i.e. root of the GitLab app).
    # secret_file: /home/git/gitlab/.gitlab_shell_secret

546
547
548
    # Git over HTTP
    upload_pack: true
    receive_pack: true
549

550
551
552
    # Git import/fetch timeout
    # git_timeout: 800

553
    # If you use non-standard ssh port you need to specify it
554
    # ssh_port: 22
555

556
557
558
559
560
  workhorse:
    # File that contains the secret key for verifying access for gitlab-workhorse.
    # Default is '.gitlab_workhorse_secret' relative to Rails.root (i.e. root of the GitLab app).
    # secret_file: /home/git/gitlab/.gitlab_workhorse_secret

561
562
563
564
565
  ## Git settings
  # CAUTION!
  # Use the default values unless you really know what you are doing
  git:
    bin_path: /usr/bin/git
dosire's avatar
dosire committed
566
567
    # The next value is the maximum memory size grit can use
    # Given in number of bytes per git object (e.g. a commit)
568
    # This value can be increased if you have very large commits
569
    max_size: 20971520 # 20.megabytes
570
    # Git timeout to read a commit, in seconds
571
    timeout: 10
Riyad Preukschas's avatar
Riyad Preukschas committed
572

573
574
575
576
577
578
579
580
581
582
  ## Webpack settings
  # If enabled, this will tell rails to serve frontend assets from the webpack-dev-server running
  # on a given port instead of serving directly from /assets/webpack. This is only indended for use
  # in development.
  webpack:
    # dev_server:
    #   enabled: true
    #   host: localhost
    #   port: 3808

583
584
585
  ## Monitoring
  # Built in monitoring settings
  monitoring:
586
587
    # Time between sampling of unicorn socket metrics, in seconds
    # unicorn_sampler_interval: 10
588
    # IP whitelist to access monitoring endpoints
589
590
    ip_whitelist:
      - 127.0.0.0/8
591

592
593
594
595
596
597
    # Sidekiq exporter is webserver built in to Sidekiq to expose Prometheus metrics
    sidekiq_exporter:
    #  enabled: true
    #  address: localhost
    #  port: 3807

598
  #
599
  # 5. Extra customization
600
601
  # ==========================

602
  extra:
603
604
605
    ## Google analytics. Uncomment if you want it
    # google_analytics_id: '_your_tracking_id'

Sebastian Winkler's avatar
Sebastian Winkler committed
606
607
608
609
    ## Piwik analytics.
    # piwik_url: '_your_piwik_url'
    # piwik_site_id: '_your_piwik_site_id'

610
611
  rack_attack:
    git_basic_auth:
612
613
614
      # Rack Attack IP banning enabled
      # enabled: true
      #
615
616
617
      # Whitelist requests from 127.0.0.1 for web proxies (NGINX/Apache) with incorrect headers
      # ip_whitelist: ["127.0.0.1"]
      #
618
619
620
621
622
623
624
625
626
      # Limit the number of Git HTTP authentication attempts per IP
      # maxretry: 10
      #
      # Reset the auth attempt counter per IP after 60 seconds
      # findtime: 60
      #
      # Ban an IP for one hour (3600s) after too many auth attempts
      # bantime: 3600

627
development:
628
  <<: *base
629
630

test:
631
  <<: *base
632
633
  gravatar:
    enabled: true
Marin Jankovski's avatar
Marin Jankovski committed
634
635
  lfs:
    enabled: false
636
637
638
  gitlab:
    host: localhost
    port: 80
639
640

    # When you run tests we clone and setup gitlab-shell
641
    # In order to setup it correctly you need to specify
642
    # your system username you use to run GitLab
643
    # user: YOUR_USERNAME
644
645
  pages:
    path: tmp/tests/pages
646
647
  repositories:
    storages:
648
649
      default:
        path: tmp/tests/repositories/
650
        gitaly_address: unix:tmp/tests/gitaly/gitaly.socket
651
652
653
        failure_count_threshold: 999999
        failure_wait_time: 0
        storage_timeout: 30
654
655
656
657
      broken:
        path: tmp/tests/non-existent-repositories
        gitaly_address: unix:tmp/tests/gitaly/gitaly.socket

658
  gitaly:
659
    enabled: true
660
    token: secret
661
  backup:
662
    path: tmp/tests/backups
663
664
665
  gitlab_shell:
    path: tmp/tests/gitlab-shell/
    hooks_path: tmp/tests/gitlab-shell/hooks/
666
667
  issues_tracker:
    redmine:
668
      title: "Redmine"
669
      project_url: "http://redmine/projects/:issues_tracker_id"
670
      issues_url: "http://redmine/:project_id/:issues_tracker_id/:id"
671
      new_issue_url: "http://redmine/projects/:issues_tracker_id/issues/new"
Felipe Artur's avatar
Felipe Artur committed
672
673
    jira:
      title: "JIRA"
674
      url: https://sample_company.atlassian.net
Felipe Artur's avatar
Felipe Artur committed
675
      project_key: PROJECT
676
677
678
679
680
681
682
683
684

  omniauth:
    enabled: true
    allow_single_sign_on: true
    external_providers: []

    providers:
      - { name: 'cas3',
          label: 'cas3',
Timothy Andrew's avatar
Timothy Andrew committed
685
          args: { url: 'https://sso.example.com',
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
                  disable_ssl_verification: false,
                  login_url: '/cas/login',
                  service_validate_url: '/cas/p3/serviceValidate',
                  logout_url: '/cas/logout'} }
      - { name: 'github',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET',
          url: "https://github.com/",
          verify_ssl: false,
          args: { scope: 'user:email' } }
      - { name: 'bitbucket',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET' }
      - { name: 'gitlab',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET',
          args: { scope: 'api' } }
      - { name: 'google_oauth2',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET',
          args: { access_type: 'offline', approval_prompt: '' } }
      - { name: 'facebook',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET' }
      - { name: 'twitter',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET' }
      - { name: 'auth0',
          args: {
            client_id: 'YOUR_AUTH0_CLIENT_ID',
            client_secret: 'YOUR_AUTH0_CLIENT_SECRET',
            namespace: 'YOUR_AUTH0_DOMAIN' } }
718
719
720
721
      - { name: 'authentiq',
          app_id: 'YOUR_CLIENT_ID',
          app_secret: 'YOUR_CLIENT_SECRET',
          args: { scope: 'aq:name email~rs address aq:push' } }
722
723
724
  ldap:
    enabled: false
    servers:
725
      main:
726
727
728
729
        label: ldap
        host: 127.0.0.1
        port: 3890
        uid: 'uid'
Michael Kozono's avatar
Michael Kozono committed
730
        encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
731
732
733
734
        base: 'dc=example,dc=com'
        user_filter: ''
        group_base: 'ou=groups,dc=example,dc=com'
        admin_group: ''
735
736

staging:
737
  <<: *base