diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -1083,6 +1083,7 @@ # puma['ssl_certificate_key'] = nil # puma['ssl_client_certificate'] = nil # puma['ssl_cipher_filter'] = nil +# puma['ssl_key_password_command'] = nil # puma['ssl_verify_mode'] = 'none' # puma['pidfile'] = '/opt/gitlab/var/puma/puma.pid' diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -569,6 +569,7 @@ default['gitlab']['puma']['ssl_certificate_key'] = nil default['gitlab']['puma']['ssl_client_certificate'] = nil default['gitlab']['puma']['ssl_cipher_filter'] = nil +default['gitlab']['puma']['ssl_key_password_command'] = nil default['gitlab']['puma']['ssl_verify_mode'] = 'none' default['gitlab']['puma']['prometheus_scrape_scheme'] = 'http' default['gitlab']['puma']['prometheus_scrape_tls_server_name'] = nil diff --git a/files/gitlab-cookbooks/gitlab/recipes/puma.rb b/files/gitlab-cookbooks/gitlab/recipes/puma.rb index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hLnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hLnJi 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/puma.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/puma.rb @@ -38,6 +38,7 @@ puma_ssl_port = node['gitlab'][svc]['ssl_port'] puma_ssl_cert = node['gitlab'][svc]['ssl_certificate'] puma_ssl_key = node['gitlab'][svc]['ssl_certificate_key'] +puma_ssl_key_password_command = node['gitlab'][svc]['ssl_key_password_command'] puma_ssl_client_cert = node['gitlab'][svc]['ssl_client_certificate'] puma_ssl_cipher_filter = node['gitlab'][svc]['ssl_cipher_filter'] puma_ssl_verify_mode = node['gitlab'][svc]['ssl_verify_mode'] @@ -85,6 +86,7 @@ ssl_certificate_key puma_ssl_key ssl_cipher_filter puma_ssl_cipher_filter ssl_client_certificate puma_ssl_client_cert + ssl_key_password_command puma_ssl_key_password_command ssl_verify_mode puma_ssl_verify_mode worker_timeout node['gitlab'][svc]['worker_timeout'] per_worker_max_memory_mb node['gitlab'][svc]['per_worker_max_memory_mb'] diff --git a/files/gitlab-cookbooks/gitlab/resources/puma_config.rb b/files/gitlab-cookbooks/gitlab/resources/puma_config.rb index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3B1bWFfY29uZmlnLnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3B1bWFfY29uZmlnLnJi 100644 --- a/files/gitlab-cookbooks/gitlab/resources/puma_config.rb +++ b/files/gitlab-cookbooks/gitlab/resources/puma_config.rb @@ -16,6 +16,7 @@ property :ssl_certificate_key, [String, nil], default: nil property :ssl_client_certificate, [String, nil], default: nil property :ssl_cipher_filter, [String, nil], default: nil +property :ssl_key_password_command, [String, nil], default: nil property :ssl_verify_mode, String, default: 'none' property :working_directory, [String, nil], default: nil property :worker_timeout, Integer, default: 60 diff --git a/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb b/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcHVtYS5yYi5lcmI=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcHVtYS5yYi5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb @@ -50,6 +50,9 @@ <%- if @ssl_certificate_key %> key: '<%= @ssl_certificate_key %>', <%- end %> + <%- if @ssl_key_password_command %> + key_password_command: '<%= @ssl_key_password_command %>', + <%- end %> <%- if @ssl_client_certificate %> ca: '<%= @ssl_client_certificate %>', <%- end %> diff --git a/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb b/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb index 88bea4d78df8db508575d63eac96326d8bd5a8f2_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hX3NwZWMucmI=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hX3NwZWMucmI= 100644 --- a/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb @@ -137,7 +137,8 @@ ssl_listen: '192.168.0.1', ssl_port: 9999, ssl_certificate: '/tmp/test.crt', - ssl_certificate_key: '/tmp/test.key' + ssl_certificate_key: '/tmp/test.key', + ssl_key_password_command: 'echo mypassword' } } end @@ -149,6 +150,9 @@ it 'renders the puma.rb file' do expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( + ssl_certificate: '/tmp/test.crt', + ssl_certificate_key: '/tmp/test.key', + ssl_key_password_command: 'echo mypassword', ssl_listen_host: '192.168.0.1', ssl_port: 9999, listen_socket: '/tmp/puma.socket', @@ -159,7 +163,7 @@ ) expect(chef_run).to render_file('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with_content { |content| - expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n cert: '\/tmp\/test.crt',\n key: '\/tmp\/test.key',\n verify_mode: 'none'\n}/m) + expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n cert: '\/tmp\/test.crt',\n key: '\/tmp\/test.key',\n key_password_command: 'echo mypassword',\n verify_mode: 'none'\n}/m) } end @@ -186,10 +190,11 @@ ssl_listen: '192.168.0.1', ssl_port: 9999, ssl_certificate: '/tmp/test.crt', - ssl_certificate_key: '/tmp/test.key' + ssl_certificate_key: '/tmp/test.key', + ssl_key_password_command: nil } } end it 'omits the UNIX socket and TCP binds from the Puma config' do expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( @@ -190,9 +195,12 @@ } } end it 'omits the UNIX socket and TCP binds from the Puma config' do expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( + ssl_certificate: '/tmp/test.crt', + ssl_certificate_key: '/tmp/test.key', + ssl_key_password_command: nil, ssl_listen_host: '192.168.0.1', ssl_port: 9999, listen_socket: '', @@ -218,6 +226,7 @@ base_params.tap do |config| config[:puma][:ssl_client_certificate] = client_cert config[:puma][:ssl_cipher_filter] = filter + config[:puma][:ssl_key_password_command] = nil config[:puma][:ssl_verify_mode] = 'peer' end end @@ -228,6 +237,7 @@ ssl_port: 9999, listen_socket: '/tmp/puma.socket', listen_tcp: '10.0.0.1:9000', + ssl_client_certificate: client_cert, ssl_cipher_filter: filter, worker_processes: 4, min_threads: 5,