diff --git a/doc/settings/configuration.md b/doc/settings/configuration.md index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ=..ab269a7991a2e0851446c7918a3d457a811ce53c_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ= 100644 --- a/doc/settings/configuration.md +++ b/doc/settings/configuration.md @@ -333,6 +333,7 @@ | `gitlab-consul` | Only when using GitLab Consul | GitLab Consul user/group | `/var/opt/gitlab/consul` | `/bin/sh` | | `registry` | Only when using GitLab Registry | GitLab Registry user/group | `/var/opt/gitlab/registry` | `/bin/sh` | | `mattermost` | Only when using GitLab Mattermost | GitLab Mattermost user/group | `/var/opt/gitlab/mattermost` | `/bin/sh` | +| `gitlab-backup` | Only when using `gitlab-backup-cli` | GitLab Backup Cli User | `/var/opt/gitlab/backups` | `/bin/sh` | To disable user and group accounts management: @@ -487,7 +488,7 @@ | Default location | Permissions | Ownership | Purpose | |--------------------------------------------------------|---------------|------------------|------------------------------------| -| `/var/opt/gitlab/git-data` | `0700` | `git:git` | Holds repositories directory | +| `/var/opt/gitlab/git-data` | `2770` | `git:git` | Holds repositories directory | | `/var/opt/gitlab/git-data/repositories` | `2770` | `git:git` | Holds Git repositories | | `/var/opt/gitlab/gitlab-rails/shared` | `0751` | `git:gitlab-www` | Holds large object directories | | `/var/opt/gitlab/gitlab-rails/shared/artifacts` | `0700` | `git:git` | Holds CI artifacts | diff --git a/docker/assets/setup b/docker/assets/setup index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZG9ja2VyL2Fzc2V0cy9zZXR1cA==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZG9ja2VyL2Fzc2V0cy9zZXR1cA== 100755 --- a/docker/assets/setup +++ b/docker/assets/setup @@ -54,6 +54,7 @@ groupadd -g 993 registry groupadd -g 992 gitlab-prometheus groupadd -g 991 gitlab-consul +groupadd -g 990 gitlab-backup # Create accounts ## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! @@ -66,3 +67,8 @@ useradd -m -u 993 -g registry -m -s /bin/sh -d /var/opt/gitlab/registry registry useradd -m -u 992 -g gitlab-prometheus -m -s /bin/sh -d /var/opt/gitlab/prometheus gitlab-prometheus useradd -m -u 991 -g gitlab-consul -m -s /bin/sh -d /var/opt/gitlab/consul gitlab-consul +useradd -m -u 990 -g gitlab-backup -m -s /bin/sh -d /var/opt/gitlab/backups gitlab-backup + +# The gitlab-backup user needs access to these groups for backup/restore purposes +usermod -a -G gitlab-psql,registry,git gitlab-backup + diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -3491,3 +3491,12 @@ # crond['log_directory'] = '/var/log/gitlab/crond' # crond['cron_d'] = '/var/opt/gitlab/crond' # crond['flags'] = {} + +#### +# gitlab-backup-cli settings +#### +# gitlab_backup_cli['enable'] = false +# gitlab_backup_cli['user'] = 'gitlab-backup' +# gitlab_backup_cli['group'] = 'gitlab-backup' +# gitlab_backup_cli['dir'] = '/var/opt/gitlab/backups' +# gitlab_backup_cli['additional_groups'] = %w[git gitlab-psql registry] diff --git a/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb b/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRhbHkvcmVjaXBlcy9naXRfZGF0YV9kaXJzLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRhbHkvcmVjaXBlcy9naXRfZGF0YV9kaXJzLnJi 100644 --- a/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb +++ b/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb @@ -25,7 +25,7 @@ storage_directory git_data_directory['path'] do owner gitlab_user group gitlab_group - mode "0700" + mode "2770" end end diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -1096,3 +1096,12 @@ default['gitlab']['runtime-dir'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['runtime_dir'] }, "node['gitlab']['runtime-dir']", "node['gitlab']['runtime_dir']") default['gitlab']['storage-check'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['storage_check'].to_h }, "node['gitlab']['storage-check']", "node['gitlab']['storage_check']") default['gitlab']['web-server'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['web_server'].to_h }, "node['gitlab']['web-server']", "node['gitlab']['web_server']") + +#### +# gitlab-backup-cli settings +#### +default['gitlab']['gitlab_backup_cli']['enable'] = false +default['gitlab']['gitlab_backup_cli']['user'] = 'gitlab-backup' +default['gitlab']['gitlab_backup_cli']['group'] = 'gitlab-backup' +default['gitlab']['gitlab_backup_cli']['dir'] = '/var/opt/gitlab/backups' +default['gitlab']['gitlab_backup_cli']['additional_groups'] = %w[git gitlab-psql registry] diff --git a/files/gitlab-cookbooks/gitlab/recipes/default.rb b/files/gitlab-cookbooks/gitlab/recipes/default.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9kZWZhdWx0LnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/default.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/default.rb @@ -83,9 +83,6 @@ # `account` custom resource will not create them. include_recipe "gitlab::users" -# Recipe for gitlab-backup-cli tool -include_recipe "gitlab::gitlab-backup-cli" - include_recipe "gitlab::gitlab-rails" if node['gitlab']['gitlab_rails']['enable'] include_recipe "gitlab::selinux" @@ -192,6 +189,13 @@ # Recipe which handles all prometheus related services include_recipe "monitoring" +# Recipe for gitlab-backup-cli tool +if node['gitlab']['gitlab_backup_cli']['enable'] + include_recipe "gitlab::gitlab-backup-cli" +else + include_recipe "gitlab::gitlab-backup-cli_disable" +end + if node['gitlab']['gitlab_rails']['database_reindexing']['enable'] include_recipe 'gitlab::database_reindexing_enable' else diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb @@ -24,3 +24,21 @@ source 'gitlab-backup-cli-config.yml.erb' sensitive true end + +account "GitLab Backup User" do + username node['gitlab']['gitlab_backup_cli']['user'] + uid node['gitlab']['gitlab_backup_cli']['uid'] + ugid node['gitlab']['gitlab_backup_cli']['group'] + groupname node['gitlab']['gitlab_backup_cli']['group'] + gid node['gitlab']['gitlab_backup_cli']['gid'] + home node['gitlab']['gitlab_backup_cli']['dir'] + manage node['gitlab']['manage_accounts']['enable'] +end + +node['gitlab']['gitlab_backup_cli']['additional_groups'].each do |group_name| + group group_name do + append true + members node['gitlab']['gitlab_backup_cli']['user'] + action :manage + end +end diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb new file mode 100644 index 0000000000000000000000000000000000000000..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9kaXNhYmxlLnJi --- /dev/null +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb @@ -0,0 +1,41 @@ +# +# Copyright:: Copyright (c) 2024 GitLab Inc. +# License:: Apache License, Version 2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +install_dir = node['package']['install-dir'] +gitlab_backup_cli_config_file = "#{install_dir}/etc/gitlab-backup-cli-config.yml" + +template gitlab_backup_cli_config_file do + owner 'root' + group 'root' + mode '0644' + source 'gitlab-backup-cli-config.yml.erb' + sensitive true + action :delete +end + +account "GitLab Backup User" do + username node['gitlab']['gitlab_backup_cli']['user'] + manage node['gitlab']['manage_accounts']['enable'] + action :remove +end + +node['gitlab']['gitlab_backup_cli']['additional_groups'].each do |group_name| + group group_name do + append true + excluded_members node['gitlab']['gitlab_backup_cli']['user'] + action :manage + end +end diff --git a/files/gitlab-cookbooks/package/libraries/config/gitlab.rb b/files/gitlab-cookbooks/package/libraries/config/gitlab.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9jb25maWcvZ2l0bGFiLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9jb25maWcvZ2l0bGFiLnJi 100644 --- a/files/gitlab-cookbooks/package/libraries/config/gitlab.rb +++ b/files/gitlab-cookbooks/package/libraries/config/gitlab.rb @@ -123,5 +123,6 @@ attribute('high_availability') attribute('web_server') attribute('prometheus_monitoring') + attribute('gitlab_backup_cli') end end diff --git a/files/gitlab-cookbooks/postgresql/recipes/enable.rb b/files/gitlab-cookbooks/postgresql/recipes/enable.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvZW5hYmxlLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvZW5hYmxlLnJi 100644 --- a/files/gitlab-cookbooks/postgresql/recipes/enable.rb +++ b/files/gitlab-cookbooks/postgresql/recipes/enable.rb @@ -30,7 +30,8 @@ directory node['postgresql']['dir'] do owner postgresql_username - mode "0755" + group postgresql_group + mode "2775" recursive true end diff --git a/files/gitlab-cookbooks/postgresql/recipes/user.rb b/files/gitlab-cookbooks/postgresql/recipes/user.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlci5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlci5yYg== 100644 --- a/files/gitlab-cookbooks/postgresql/recipes/user.rb +++ b/files/gitlab-cookbooks/postgresql/recipes/user.rb @@ -32,7 +32,8 @@ directory node['postgresql']['home'] do owner postgresql_username - mode "0755" + group postgresql_group + mode "2775" recursive true end diff --git a/files/gitlab-cookbooks/registry/recipes/enable.rb b/files/gitlab-cookbooks/registry/recipes/enable.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWdpc3RyeS9yZWNpcGVzL2VuYWJsZS5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWdpc3RyeS9yZWNpcGVzL2VuYWJsZS5yYg== 100644 --- a/files/gitlab-cookbooks/registry/recipes/enable.rb +++ b/files/gitlab-cookbooks/registry/recipes/enable.rb @@ -43,7 +43,8 @@ directory "create #{working_dir} and set the owner" do path working_dir owner account_helper.registry_user - mode '0700' + group account_helper.registry_group + mode '2770' recursive true end diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb new file mode 100644 index 0000000000000000000000000000000000000000..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS1kaXNhYmxlX3NwZWMucmI= --- /dev/null +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb @@ -0,0 +1,54 @@ +# +# Copyright:: Copyright (c) 2024 GitLab Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +require 'chef_helper' + +RSpec.describe 'gitlab::gitlab-backup-cli-disable' do + let(:chef_runner) do + ChefSpec::SoloRunner.new do |node| + node.normal['package']['install-dir'] = '/opt/gitlab' + end + end + + let(:chef_run) do + chef_runner.converge('gitlab::default') + end + + let(:template_path) { '/opt/gitlab/etc/gitlab-backup-cli-config.yml' } + + context 'by default' do + it 'is included' do + expect(chef_run).to include_recipe('gitlab::gitlab-backup-cli_disable') + end + + it 'removes the gitlab-backup-cli-config.yml template' do + expect(chef_run).to delete_template(template_path) + end + + it 'removes the gitlab-backup user' do + expect(chef_run).to remove_account('GitLab Backup User') + end + + it 'removes the gitlab-backup user from the appropriate groups' do + %w[git gitlab-psql registry].each do |group| + expect(chef_run).to manage_group(group).with( + excluded_members: ['gitlab-backup'], + append: true + ) + end + end + end +end diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb @@ -29,7 +29,9 @@ let(:template_path) { '/opt/gitlab/etc/gitlab-backup-cli-config.yml' } - before do - allow(Gitlab).to receive(:[]).and_call_original + context 'by default' do + it 'does not run' do + expect(chef_run).not_to include_recipe('gitlab::gitlab-backup-cli') + end end @@ -34,12 +36,44 @@ end - it 'creates gitlab-backup-cli-config.yml template' do - expect(chef_run).to create_template(template_path).with( - owner: 'root', - group: 'root', - mode: '0644', - source: 'gitlab-backup-cli-config.yml.erb', - sensitive: true - ) + context 'when enabled' do + before do + allow(Gitlab).to receive(:[]).and_call_original + stub_gitlab_rb( + gitlab_backup_cli: { + enable: true + } + ) + end + + it 'includes the recipe' do + expect(chef_run).to include_recipe('gitlab::gitlab-backup-cli') + end + + it 'creates gitlab-backup-cli-config.yml template' do + expect(chef_run).to create_template(template_path).with( + owner: 'root', + group: 'root', + mode: '0644', + source: 'gitlab-backup-cli-config.yml.erb', + sensitive: true + ) + end + + it 'creates a gitlab-backup user' do + expect(chef_run).to create_account('GitLab Backup User').with( + username: 'gitlab-backup', + groupname: 'gitlab-backup', + home: '/var/opt/gitlab/backups' + ) + end + + it 'adds the gitlab-backup user to the appropriate groups' do + %w[git gitlab-psql registry].each do |group| + expect(chef_run).to manage_group(group).with( + members: ['gitlab-backup'], + append: true + ) + end + end end end diff --git a/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb b/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvcG9zdGdyZXNxbF9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvcG9zdGdyZXNxbF9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb +++ b/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb @@ -919,7 +919,12 @@ context 'postgresql directory' do context 'with default settings' do it 'creates postgresql directory' do - expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with(owner: 'gitlab-psql', mode: '0755', recursive: true) + expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with( + owner: 'gitlab-psql', + group: 'gitlab-psql', + mode: '2775', + recursive: true + ) end end @@ -933,7 +938,12 @@ end it 'creates postgresql directory with custom path' do - expect(chef_run).to create_directory('/mypgdir').with(owner: 'gitlab-psql', mode: '0755', recursive: true) + expect(chef_run).to create_directory('/mypgdir').with( + owner: 'gitlab-psql', + group: 'gitlab-psql', + mode: '2775', + recursive: true + ) end end end diff --git a/spec/chef/cookbooks/postgresql/recipes/user_spec.rb b/spec/chef/cookbooks/postgresql/recipes/user_spec.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlcl9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlcl9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/postgresql/recipes/user_spec.rb +++ b/spec/chef/cookbooks/postgresql/recipes/user_spec.rb @@ -26,7 +26,8 @@ it 'creates postgresql base directory' do directory_params = { owner: 'gitlab-psql', - mode: '0755', + group: 'gitlab-psql', + mode: '2775', recursive: true } expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with(directory_params) @@ -66,10 +67,11 @@ it 'creates postgresql base directory' do directory_params = { owner: 'gitlab-psql', - mode: '0755', + group: 'gitlab-psql', + mode: '2775', recursive: true } expect(chef_run).to create_directory('/mypghomedir').with(directory_params) end it 'creates necessary directories' do @@ -70,10 +72,15 @@ recursive: true } expect(chef_run).to create_directory('/mypghomedir').with(directory_params) end it 'creates necessary directories' do - expect(chef_run).to create_directory('/mypghomedir').with(owner: 'gitlab-psql', mode: '0755', recursive: true) + expect(chef_run).to create_directory('/mypghomedir').with( + owner: 'gitlab-psql', + group: 'gitlab-psql', + mode: '2775', + recursive: true + ) end end end diff --git a/spec/chef/support/shared_examples/git_data_dirs.rb b/spec/chef/support/shared_examples/git_data_dirs.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL2dpdF9kYXRhX2RpcnMucmI=..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL2dpdF9kYXRhX2RpcnMucmI= 100644 --- a/spec/chef/support/shared_examples/git_data_dirs.rb +++ b/spec/chef/support/shared_examples/git_data_dirs.rb @@ -1,6 +1,6 @@ RSpec.shared_examples 'git data directory' do |git_data_path| it 'creates the git-data directory' do - expect(chef_run).to create_storage_directory(git_data_path).with(owner: 'git', group: 'git', mode: '0700') + expect(chef_run).to create_storage_directory(git_data_path).with(owner: 'git', group: 'git', mode: '2770') end it 'creates the repositories directory' do diff --git a/spec/chef/support/shared_examples/registry_service.rb b/spec/chef/support/shared_examples/registry_service.rb index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL3JlZ2lzdHJ5X3NlcnZpY2UucmI=..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL3JlZ2lzdHJ5X3NlcnZpY2UucmI= 100644 --- a/spec/chef/support/shared_examples/registry_service.rb +++ b/spec/chef/support/shared_examples/registry_service.rb @@ -5,7 +5,11 @@ expect(chef_run.node['gitlab']['gitlab_rails']['registry_path']) .to eql('/var/opt/gitlab/gitlab-rails/shared/registry') - expect(chef_run).to create_directory('/var/opt/gitlab/registry') + expect(chef_run).to create_directory('/var/opt/gitlab/registry').with( + owner: 'registry', + group: 'registry', + mode: '2770' + ) expect(chef_run).to create_directory('/var/opt/gitlab/gitlab-rails/shared/registry').with( owner: 'registry', group: 'git',