Skip to content
Snippets Groups Projects
Commit 26cbeb11ac1b authored by Ercan Ucan's avatar Ercan Ucan
Browse files

feat(gitlab-pages): add gitlab-pages auth-scope configuration parameter

Depends on https://gitlab.com/gitlab-org/gitlab-pages/-/merge_requests/423.

This MR adapts Omnibus to expose `auth-scope` configuration parameter for
Gitlab Pages as implemented in MR:
https://gitlab.com/gitlab-org/gitlab-pages/-/merge_requests/423

:tools: with :heart: at Siemens
parent 9d03f47d9191
1 merge request!26GitLab 13.9
......@@ -14,7 +14,7 @@
See the table below for the list of ports that the Omnibus GitLab assigns
by default:
| Component | On by default | Communicates via | Alternative | Connection port |
| Component | On by default | Communicates via | Alternative | Connection port |
| :----------------------------------------------------: | :------------:| :--------------: | :---------: | :------------------------------------: |
| <a name="gitlab-rails"></a> GitLab Rails | Yes | Port | X | 80 or 443 |
| <a name="gitlab-shell"></a> GitLab Shell | Yes | Port | X | 22 |
......@@ -39,7 +39,7 @@
| <a name="incoming-email"></a> Incoming email | No | Port | X | 143 |
| <a name="elasticsearch"></a> Elastic search | No | Port | X | 9200 |
| <a name="gitlab-pages"></a> GitLab Pages | No | Port | X | 80 or 443 |
| <a name="gitlab-registry-web"></a> GitLab Registry | No* | Port | X | 80, 443 or 5050 |
| <a name="gitlab-registry-web"></a> GitLab Registry | No* | Port | X | 80, 443 or 5050 |
| <a name="gitlab-registry"></a> GitLab Registry | No | Port | X | 5000 |
| <a name="ldap"></a> LDAP | No | Port | X | Depends on the component configuration |
| <a name="kerberos"></a> Kerberos | No | Port | X | 8443 or 8088 |
......
......@@ -1559,5 +1559,5 @@
# gitlab_pages['gitlab_secret'] = nil # Generated if not present
# gitlab_pages['auth_redirect_uri'] = nil # Defaults to projects subdomain of pages_external_url and + '/auth'
# gitlab_pages['gitlab_server'] = nil # Defaults to external_url
# gitlab_pages['internal_gitlab_server'] = nil # defaults to gitlab_server, can be changed to internal load balancer
# gitlab_pages['internal_gitlab_server'] = nil # Defaults to gitlab_server, can be changed to internal load balancer
# gitlab_pages['auth_secret'] = nil # Generated if not present
......@@ -1563,4 +1563,5 @@
# gitlab_pages['auth_secret'] = nil # Generated if not present
# gitlab_pages['auth_scope'] = nil # Defaults to api, can be changed to read_api to increase security
##! GitLab API HTTP client connection timeout
# gitlab_pages['gitlab_client_http_timeout'] = "10s"
......
......@@ -31,6 +31,7 @@
default['gitlab-pages']['gitlab_secret'] = nil
default['gitlab-pages']['auth_redirect_uri'] = nil
default['gitlab-pages']['auth_secret'] = nil
default['gitlab-pages']['auth_scope'] = nil
default['gitlab-pages']['insecure_ciphers'] = false
default['gitlab-pages']['tls_min_version'] = nil
default['gitlab-pages']['tls_max_version'] = nil
......
......@@ -17,6 +17,9 @@
<%- if @auth_secret -%>
auth-secret=<%= @auth_secret %>
<%- end -%>
<%- if @auth_scope -%>
auth-scope=<%= @auth_scope %>
<%- end -%>
<%- end -%>
<%- if @zip_cache_expiration -%>
zip-cache-expiration=<%= @zip_cache_expiration %>
......
......@@ -134,6 +134,7 @@
gitlab_secret: 'app_secret',
auth_secret: 'auth_secret',
auth_redirect_uri: 'https://projects.pages.example.com/auth',
auth_scope: 'read_api'
}
)
end
......@@ -148,6 +149,7 @@
expect(content).to match(%r{auth-client-secret=app_secret})
expect(content).to match(%r{auth-redirect-uri=https://projects.pages.example.com/auth})
expect(content).to match(%r{auth-secret=auth_secret})
expect(content).to match(%r{auth-scope=read_api})
}
end
end
......@@ -177,6 +179,7 @@
gitlab_secret: 'app_secret',
auth_secret: 'auth_secret',
auth_redirect_uri: 'https://projects.pages.example.com/auth',
auth_scope: 'read_api',
access_control: true,
insecure_ciphers: true,
tls_min_version: "tls1.0",
......@@ -212,6 +215,7 @@
auth-redirect-uri=https://projects.pages.example.com/auth
auth-client-secret=app_secret
auth-secret=auth_secret
auth-scope=read_api
zip-cache-expiration=120s
zip-cache-cleanup=1m
zip-cache-refresh=60s
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment