diff --git a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb index f498338a5ebd0840ff0a40b0b1d83e8a048609fc_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg==..d6466e460706925c27055b3e246afadf8a013269_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb +++ b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb @@ -90,11 +90,12 @@ pages_uri = URI(Gitlab['pages_external_url'].to_s) parsed_port = [80, 443].include?(pages_uri.port) ? "" : ":#{pages_uri.port}" - Gitlab['gitlab_pages']['auth_redirect_uri'] = if Gitlab['gitlab_pages']['namespace_in_path'] - "#{pages_uri.scheme}://#{pages_uri.host}#{parsed_port}/projects/auth" - else - "#{pages_uri.scheme}://projects.#{pages_uri.host}#{parsed_port}/auth" - end + Gitlab['gitlab_pages']['auth_redirect_uri'] = + if Gitlab['gitlab_pages']['namespace_in_path'] + "#{pages_uri.scheme}://#{pages_uri.host}#{parsed_port}/projects/auth" + else + "#{pages_uri.scheme}://projects.#{pages_uri.host}#{parsed_port}/auth" + end end def authorize_with_gitlab @@ -150,5 +151,11 @@ url_scheme = Gitlab['gitlab_rails']['pages_https'] ? 'https' : 'http' pages_port = Gitlab['gitlab_rails']['pages_port'] - redirect_uri = Gitlab['gitlab_pages']['auth_redirect_uri'].gsub('.', '\.') + + Gitlab['pages_nginx']['proxy_redirect'] = {} + unless Gitlab['gitlab_pages']['auth_redirect_uri'].nil? + redirect_uri = Gitlab['gitlab_pages']['auth_redirect_uri'].gsub('.', '\.') + Gitlab['pages_nginx']['proxy_redirect'] = { "~^(#{redirect_uri})(.*)$" => "$1$2" } + end + # Add the following when pages_port is not 80 or 443 @@ -154,4 +161,4 @@ # Add the following when pages_port is not 80 or 443 - Gitlab['pages_nginx']['proxy_redirect'] = + proxy_redirect_rules = if [80, 443].include?(pages_port) { @@ -156,9 +163,8 @@ if [80, 443].include?(pages_port) { - "~^(#{redirect_uri})(.*)$" => "$1$2", "~^#{url_scheme}://([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^//([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^/(.*)$" => "#{url_scheme}://#{Gitlab['pages_nginx']['fqdn_regex']}/$namespace/$1", } else { @@ -159,12 +165,11 @@ "~^#{url_scheme}://([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^//([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^/(.*)$" => "#{url_scheme}://#{Gitlab['pages_nginx']['fqdn_regex']}/$namespace/$1", } else { - "~^(#{redirect_uri})(.*)$" => "$1$2", "~^#{url_scheme}://([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^//([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^/(.*)$" => "#{url_scheme}://#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port}/$namespace/$1", } end @@ -166,8 +171,10 @@ "~^#{url_scheme}://([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^//([^/]*)\\.(#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port})/(.*)$" => "#{url_scheme}://$2/$1/$3", "~^/(.*)$" => "#{url_scheme}://#{Gitlab['pages_nginx']['fqdn_regex']}:#{pages_port}/$namespace/$1", } end + + Gitlab['pages_nginx']['proxy_redirect'].merge!(proxy_redirect_rules) end end end diff --git a/spec/chef/cookbooks/gitlab/recipes/nginx_spec.rb b/spec/chef/cookbooks/gitlab/recipes/nginx_spec.rb index f498338a5ebd0840ff0a40b0b1d83e8a048609fc_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9uZ2lueF9zcGVjLnJi..d6466e460706925c27055b3e246afadf8a013269_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9uZ2lueF9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/gitlab/recipes/nginx_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/nginx_spec.rb @@ -901,8 +901,8 @@ expect(chef_run.node['gitlab_pages']['namespace_in_path']).to eql(false) end - context 'when namespace_in_path is enabled in gitlab_pages' do + context 'when namespace_in_path is enabled and access_control is enabled in gitlab_pages' do before do stub_gitlab_rb( gitlab_pages: { namespace_in_path: true, @@ -905,8 +905,8 @@ before do stub_gitlab_rb( gitlab_pages: { namespace_in_path: true, - auth_redirect_uri: 'https://projects.pages.localhost/auth', + access_control: true, } ) end @@ -921,7 +921,41 @@ expect(content).to include('rewrite ^/([^/]+)/(.*)$ /$2 break;') expect(content).to include('proxy_set_header Host $1.$http_host;') expect(content).to include('proxy_set_header X-Gitlab-Namespace-In-Path $namespace;') - expect(content).to include('proxy_redirect ~^(https://projects\.pages\.localhost/auth)(.*)$ $1$2;') + expect(content).to include('proxy_redirect ~^(https://pages\.localhost/projects/auth)(.*)$ $1$2;') + expect(content).to include('proxy_redirect ~^https://([^/]*)\.(pages\.localhost)/(.*)$ https://$2/$1/$3;') + expect(content).to include('proxy_redirect ~^//([^/]*)\.(pages\.localhost)/(.*)$ https://$2/$1/$3;') + expect(content).to include('proxy_redirect ~^/(.*)$ https://pages\.localhost/$namespace/$1;') + expect(content).to include('proxy_hide_header X-Gitlab-Namespace-In-Path;') + # Below checks are to verify proper render entries are made + expect(content).to include('proxy_http_version 1.1;').twice + expect(content).to include('proxy_pass').twice + expect(content).to include('disable_symlinks on;').twice + expect(content).to include('server_tokens off;').twice + } + end + end + + context 'when namespace_in_path is enabled and access_control is disabled in gitlab_pages' do + before do + stub_gitlab_rb( + gitlab_pages: { + namespace_in_path: true, + access_control: false, + } + ) + end + + it 'applies nginx namespace_in_path settings for gitlab-pages' do + expect(chef_run).to render_file(http_conf['pages']).with_content { |content| + expect(content).to include('server {').twice + expect(content).to include('server_name ~^pages\.localhost$;') + expect(content).to include('location ~ ^/(?<namespace>[^/]+)$ {') + expect(content).to include('return 301 $scheme://$http_host$request_uri/;') + expect(content).to include('location ~ ^/(?<namespace>[^/]+)/(?<project>.*)$ {') + expect(content).to include('rewrite ^/([^/]+)/(.*)$ /$2 break;') + expect(content).to include('proxy_set_header Host $1.$http_host;') + expect(content).to include('proxy_set_header X-Gitlab-Namespace-In-Path $namespace;') + expect(content).not_to include('proxy_redirect ~^(https://pages\.localhost/projects/auth)(.*)$ $1$2;') expect(content).to include('proxy_redirect ~^https://([^/]*)\.(pages\.localhost)/(.*)$ https://$2/$1/$3;') expect(content).to include('proxy_redirect ~^//([^/]*)\.(pages\.localhost)/(.*)$ https://$2/$1/$3;') expect(content).to include('proxy_redirect ~^/(.*)$ https://pages\.localhost/$namespace/$1;') @@ -941,7 +975,7 @@ pages_external_url: 'https://pages.localhost:25800', gitlab_pages: { namespace_in_path: true, - auth_redirect_uri: 'https://projects.pages.localhost/auth', + access_control: true, } ) end @@ -957,7 +991,7 @@ expect(content).to include('rewrite ^/([^/]+)/(.*)$ /$2 break;') expect(content).to include('proxy_set_header Host $1.$http_host;') expect(content).to include('proxy_set_header X-Gitlab-Namespace-In-Path $namespace;') - expect(content).to include('proxy_redirect ~^(https://projects\.pages\.localhost/auth)(.*)$ $1$2;') + expect(content).to include('proxy_redirect ~^(https://pages\.localhost:25800/projects/auth)(.*)$ $1$2;') expect(content).to include('proxy_redirect ~^https://([^/]*)\.(pages\.localhost:25800)/(.*)$ https://$2/$1/$3;') expect(content).to include('proxy_redirect ~^//([^/]*)\.(pages\.localhost:25800)/(.*)$ https://$2/$1/$3;') expect(content).to include('proxy_redirect ~^/(.*)$ https://pages\.localhost:25800/$namespace/$1;')