Skip to content
Snippets Groups Projects
Commit 49eee514 authored by Stan Hu's avatar Stan Hu
Browse files

Support Puma key_password_command for SSL key decryption

This commit adds support for `puma['ssl_key_password_command']` to
make it possible to store encrypted SSL keys on disk.

This requires Puma v6.3.0 (https://github.com/puma/puma/pull/3133) to
work: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/122200.

Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7799

Changelog: added
parent 88bea4d7
No related branches found
No related tags found
1 merge request!100Upstream Merge of 16.1 CE branching point
...@@ -1083,6 +1083,7 @@ ...@@ -1083,6 +1083,7 @@
# puma['ssl_certificate_key'] = nil # puma['ssl_certificate_key'] = nil
# puma['ssl_client_certificate'] = nil # puma['ssl_client_certificate'] = nil
# puma['ssl_cipher_filter'] = nil # puma['ssl_cipher_filter'] = nil
# puma['ssl_key_password_command'] = nil
# puma['ssl_verify_mode'] = 'none' # puma['ssl_verify_mode'] = 'none'
# puma['pidfile'] = '/opt/gitlab/var/puma/puma.pid' # puma['pidfile'] = '/opt/gitlab/var/puma/puma.pid'
......
...@@ -569,6 +569,7 @@ ...@@ -569,6 +569,7 @@
default['gitlab']['puma']['ssl_certificate_key'] = nil default['gitlab']['puma']['ssl_certificate_key'] = nil
default['gitlab']['puma']['ssl_client_certificate'] = nil default['gitlab']['puma']['ssl_client_certificate'] = nil
default['gitlab']['puma']['ssl_cipher_filter'] = nil default['gitlab']['puma']['ssl_cipher_filter'] = nil
default['gitlab']['puma']['ssl_key_password_command'] = nil
default['gitlab']['puma']['ssl_verify_mode'] = 'none' default['gitlab']['puma']['ssl_verify_mode'] = 'none'
default['gitlab']['puma']['prometheus_scrape_scheme'] = 'http' default['gitlab']['puma']['prometheus_scrape_scheme'] = 'http'
default['gitlab']['puma']['prometheus_scrape_tls_server_name'] = nil default['gitlab']['puma']['prometheus_scrape_tls_server_name'] = nil
......
...@@ -38,6 +38,7 @@ ...@@ -38,6 +38,7 @@
puma_ssl_port = node['gitlab'][svc]['ssl_port'] puma_ssl_port = node['gitlab'][svc]['ssl_port']
puma_ssl_cert = node['gitlab'][svc]['ssl_certificate'] puma_ssl_cert = node['gitlab'][svc]['ssl_certificate']
puma_ssl_key = node['gitlab'][svc]['ssl_certificate_key'] puma_ssl_key = node['gitlab'][svc]['ssl_certificate_key']
puma_ssl_key_password_command = node['gitlab'][svc]['ssl_key_password_command']
puma_ssl_client_cert = node['gitlab'][svc]['ssl_client_certificate'] puma_ssl_client_cert = node['gitlab'][svc]['ssl_client_certificate']
puma_ssl_cipher_filter = node['gitlab'][svc]['ssl_cipher_filter'] puma_ssl_cipher_filter = node['gitlab'][svc]['ssl_cipher_filter']
puma_ssl_verify_mode = node['gitlab'][svc]['ssl_verify_mode'] puma_ssl_verify_mode = node['gitlab'][svc]['ssl_verify_mode']
...@@ -85,6 +86,7 @@ ...@@ -85,6 +86,7 @@
ssl_certificate_key puma_ssl_key ssl_certificate_key puma_ssl_key
ssl_cipher_filter puma_ssl_cipher_filter ssl_cipher_filter puma_ssl_cipher_filter
ssl_client_certificate puma_ssl_client_cert ssl_client_certificate puma_ssl_client_cert
ssl_key_password_command puma_ssl_key_password_command
ssl_verify_mode puma_ssl_verify_mode ssl_verify_mode puma_ssl_verify_mode
worker_timeout node['gitlab'][svc]['worker_timeout'] worker_timeout node['gitlab'][svc]['worker_timeout']
per_worker_max_memory_mb node['gitlab'][svc]['per_worker_max_memory_mb'] per_worker_max_memory_mb node['gitlab'][svc]['per_worker_max_memory_mb']
......
...@@ -16,6 +16,7 @@ ...@@ -16,6 +16,7 @@
property :ssl_certificate_key, [String, nil], default: nil property :ssl_certificate_key, [String, nil], default: nil
property :ssl_client_certificate, [String, nil], default: nil property :ssl_client_certificate, [String, nil], default: nil
property :ssl_cipher_filter, [String, nil], default: nil property :ssl_cipher_filter, [String, nil], default: nil
property :ssl_key_password_command, [String, nil], default: nil
property :ssl_verify_mode, String, default: 'none' property :ssl_verify_mode, String, default: 'none'
property :working_directory, [String, nil], default: nil property :working_directory, [String, nil], default: nil
property :worker_timeout, Integer, default: 60 property :worker_timeout, Integer, default: 60
......
...@@ -50,6 +50,9 @@ ...@@ -50,6 +50,9 @@
<%- if @ssl_certificate_key %> <%- if @ssl_certificate_key %>
key: '<%= @ssl_certificate_key %>', key: '<%= @ssl_certificate_key %>',
<%- end %> <%- end %>
<%- if @ssl_key_password_command %>
key_password_command: '<%= @ssl_key_password_command %>',
<%- end %>
<%- if @ssl_client_certificate %> <%- if @ssl_client_certificate %>
ca: '<%= @ssl_client_certificate %>', ca: '<%= @ssl_client_certificate %>',
<%- end %> <%- end %>
......
...@@ -137,7 +137,8 @@ ...@@ -137,7 +137,8 @@
ssl_listen: '192.168.0.1', ssl_listen: '192.168.0.1',
ssl_port: 9999, ssl_port: 9999,
ssl_certificate: '/tmp/test.crt', ssl_certificate: '/tmp/test.crt',
ssl_certificate_key: '/tmp/test.key' ssl_certificate_key: '/tmp/test.key',
ssl_key_password_command: 'echo mypassword'
} }
} }
end end
...@@ -149,6 +150,9 @@ ...@@ -149,6 +150,9 @@
it 'renders the puma.rb file' do it 'renders the puma.rb file' do
expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
ssl_certificate: '/tmp/test.crt',
ssl_certificate_key: '/tmp/test.key',
ssl_key_password_command: 'echo mypassword',
ssl_listen_host: '192.168.0.1', ssl_listen_host: '192.168.0.1',
ssl_port: 9999, ssl_port: 9999,
listen_socket: '/tmp/puma.socket', listen_socket: '/tmp/puma.socket',
...@@ -159,7 +163,7 @@ ...@@ -159,7 +163,7 @@
) )
expect(chef_run).to render_file('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with_content { |content| expect(chef_run).to render_file('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with_content { |content|
expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n cert: '\/tmp\/test.crt',\n key: '\/tmp\/test.key',\n verify_mode: 'none'\n}/m) expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n cert: '\/tmp\/test.crt',\n key: '\/tmp\/test.key',\n key_password_command: 'echo mypassword',\n verify_mode: 'none'\n}/m)
} }
end end
...@@ -186,10 +190,11 @@ ...@@ -186,10 +190,11 @@
ssl_listen: '192.168.0.1', ssl_listen: '192.168.0.1',
ssl_port: 9999, ssl_port: 9999,
ssl_certificate: '/tmp/test.crt', ssl_certificate: '/tmp/test.crt',
ssl_certificate_key: '/tmp/test.key' ssl_certificate_key: '/tmp/test.key',
ssl_key_password_command: nil
} }
} }
end end
it 'omits the UNIX socket and TCP binds from the Puma config' do it 'omits the UNIX socket and TCP binds from the Puma config' do
expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
...@@ -190,9 +195,12 @@ ...@@ -190,9 +195,12 @@
} }
} }
end end
it 'omits the UNIX socket and TCP binds from the Puma config' do it 'omits the UNIX socket and TCP binds from the Puma config' do
expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with( expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
ssl_certificate: '/tmp/test.crt',
ssl_certificate_key: '/tmp/test.key',
ssl_key_password_command: nil,
ssl_listen_host: '192.168.0.1', ssl_listen_host: '192.168.0.1',
ssl_port: 9999, ssl_port: 9999,
listen_socket: '', listen_socket: '',
...@@ -218,6 +226,7 @@ ...@@ -218,6 +226,7 @@
base_params.tap do |config| base_params.tap do |config|
config[:puma][:ssl_client_certificate] = client_cert config[:puma][:ssl_client_certificate] = client_cert
config[:puma][:ssl_cipher_filter] = filter config[:puma][:ssl_cipher_filter] = filter
config[:puma][:ssl_key_password_command] = nil
config[:puma][:ssl_verify_mode] = 'peer' config[:puma][:ssl_verify_mode] = 'peer'
end end
end end
...@@ -228,6 +237,7 @@ ...@@ -228,6 +237,7 @@
ssl_port: 9999, ssl_port: 9999,
listen_socket: '/tmp/puma.socket', listen_socket: '/tmp/puma.socket',
listen_tcp: '10.0.0.1:9000', listen_tcp: '10.0.0.1:9000',
ssl_client_certificate: client_cert,
ssl_cipher_filter: filter, ssl_cipher_filter: filter,
worker_processes: 4, worker_processes: 4,
min_threads: 5, min_threads: 5,
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment