Skip to content
Snippets Groups Projects
Commit 964dfc72 authored by Dustin Collins's avatar Dustin Collins
Browse files

Use first entry in allowed_hosts, if set, for healthcheck

Changelog: changed
parent 3eceb608
No related branches found
No related tags found
2 merge requests!102heptapod#1237: making 0.38 the new oldstable,!90Merged upstream 15.9.0+ce.0 into heptapod branch
...@@ -32,7 +32,7 @@ ...@@ -32,7 +32,7 @@
block do block do
File.open("#{install_dir}/bin/gitlab-healthcheck", 'w') do |file| File.open("#{install_dir}/bin/gitlab-healthcheck", 'w') do |file|
file.print <<-EOH file.print <<-EOH
#!/bin/sh #!/bin/bash
error_echo() error_echo()
{ {
...@@ -48,7 +48,7 @@ ...@@ -48,7 +48,7 @@
. ${gitlab_healthcheck_rc} . ${gitlab_healthcheck_rc}
exec /opt/gitlab/embedded/bin/curl $@ ${flags} ${url} exec /opt/gitlab/embedded/bin/curl "$@" "${flags[@]}" "${url}"
EOH EOH
end end
end end
......
...@@ -16,6 +16,7 @@ ...@@ -16,6 +16,7 @@
# #
workhorse_helper = GitlabWorkhorseHelper.new(node) workhorse_helper = GitlabWorkhorseHelper.new(node)
flags = []
# If nginx is disabled we will use workhorse for the healthcheck # If nginx is disabled we will use workhorse for the healthcheck
if node['gitlab']['nginx']['enable'] if node['gitlab']['nginx']['enable']
...@@ -23,9 +24,12 @@ ...@@ -23,9 +24,12 @@
# Fallback to the setting derived from external_url # Fallback to the setting derived from external_url
listen_https = node['gitlab']['gitlab-rails']['gitlab_https'] if listen_https.nil? listen_https = node['gitlab']['gitlab-rails']['gitlab_https'] if listen_https.nil?
schema = listen_https ? 'https' : 'http' schema = listen_https ? 'https' : 'http'
# Only check on the local network # Check first allowed_host, fallback to checking localhost
allowed_hosts = node['gitlab']['gitlab-rails']['allowed_hosts']
flags << "--header \"Host: #{allowed_hosts[0]}\"" unless allowed_hosts.empty?
flags << '--insecure'
host = "localhost:#{node['gitlab']['nginx']['listen_port']}" host = "localhost:#{node['gitlab']['nginx']['listen_port']}"
else else
# Always use http for workhorse # Always use http for workhorse
schema = 'http' schema = 'http'
use_socket = workhorse_helper.unix_socket? use_socket = workhorse_helper.unix_socket?
...@@ -27,8 +31,15 @@ ...@@ -27,8 +31,15 @@
host = "localhost:#{node['gitlab']['nginx']['listen_port']}" host = "localhost:#{node['gitlab']['nginx']['listen_port']}"
else else
# Always use http for workhorse # Always use http for workhorse
schema = 'http' schema = 'http'
use_socket = workhorse_helper.unix_socket? use_socket = workhorse_helper.unix_socket?
socket_path = use_socket ? node['gitlab']['gitlab-workhorse']['listen_addr'] : ''
if use_socket
flags << '--unix-socket'
flags << socket_path
else
flags << '--insecure'
end
host = use_socket ? 'localhost' : node['gitlab']['gitlab-workhorse']['listen_addr'] host = use_socket ? 'localhost' : node['gitlab']['gitlab-workhorse']['listen_addr']
end end
...@@ -37,9 +48,8 @@ ...@@ -37,9 +48,8 @@
group 'root' group 'root'
variables( variables(
{ {
use_socket: use_socket, url: "#{schema}://#{host}#{Gitlab['gitlab_rails']['gitlab_relative_url']}/help",
socket_path: use_socket ? node['gitlab']['gitlab-workhorse']['listen_addr'] : '', flags: flags.join(' ')
url: "#{schema}://#{host}#{Gitlab['gitlab_rails']['gitlab_relative_url']}/help"
} }
) )
end end
url='<%= @url %>' url='<%= @url %>'
<% if @use_socket %> flags=(<%= @flags %>)
flags='--unix-socket <%= @socket_path %>'
<% else %>
flags='--insecure'
<% end %>
...@@ -15,7 +15,8 @@ ...@@ -15,7 +15,8 @@
it 'correctly renders the healthcheck-rc file' do it 'correctly renders the healthcheck-rc file' do
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc") expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{url='http://localhost:80/help'}) .with_content(%r{url='http://localhost:80/help'})
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc").with_content(%r{flags='--insecure'}) expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{flags=\(--insecure\)})
end end
it 'correctly renders out the healthcheck-rc file when using https' do it 'correctly renders out the healthcheck-rc file when using https' do
...@@ -35,6 +36,17 @@ ...@@ -35,6 +36,17 @@
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc") expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{url='http://localhost:80/custom/help'}) .with_content(%r{url='http://localhost:80/custom/help'})
end end
it 'correctly renders out the healthcheck-rc file when setting allowed_hosts' do
stub_gitlab_rb(
external_url: 'https://gitlab.example.com',
gitlab_rails: { allowed_hosts: ['gitlab.example.com'] }
)
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{url='https://localhost:443/help'})
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{flags=\(--header "Host: gitlab.example.com" --insecure\)})
end
end end
context 'nginx is disabled' do context 'nginx is disabled' do
...@@ -46,7 +58,7 @@ ...@@ -46,7 +58,7 @@
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc") expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{url='http://localhost/help'}) .with_content(%r{url='http://localhost/help'})
expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc") expect(chef_run).to render_file("/opt/gitlab/etc/gitlab-healthcheck-rc")
.with_content(%r{flags='--unix-socket /var/opt/gitlab/gitlab-workhorse/sockets/socket'}) .with_content(%r{flags=\(--unix-socket /var/opt/gitlab/gitlab-workhorse/sockets/socket\)})
end end
it 'correctly renders healthcheck-rc file using workhorse on a port' do it 'correctly renders healthcheck-rc file using workhorse on a port' do
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment