diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index ddb5807b53535db93242accdd219ee682e3e833c_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..e17e28e65f0e5a21eff03ba6a9c2b9ecc0dd8610_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -1733,5 +1733,7 @@ ##! enable `FF_ENABLE_RATE_LIMITER=true` environment variable to ##! reject requests. -##! Rate limit per source IP in number of requests per second, 0 means is disabled +##! Rate limits as described in https://docs.gitlab.com/ee/administration/pages/#rate-limits + +##! Rate limit HTTP requests per second from a single IP, 0 means is disabled # gitlab_pages['rate_limit_source_ip'] = 50.0 @@ -1737,3 +1739,3 @@ # gitlab_pages['rate_limit_source_ip'] = 50.0 -##! Rate limit per source IP maximum burst allowed per second +##! Rate limit HTTP requests from a single IP, maximum burst allowed per second # gitlab_pages['rate_limit_source_ip_burst'] = 600 @@ -1739,3 +1741,3 @@ # gitlab_pages['rate_limit_source_ip_burst'] = 600 -##! Rate limit per domain name in number of requests per second, 0 means is disabled +##! Rate limit HTTP requests per second to a single domain, 0 means is disabled # gitlab_pages['rate_limit_domain'] = 0 @@ -1741,4 +1743,4 @@ # gitlab_pages['rate_limit_domain'] = 0 -##! Rate limit per domain name maximum burst allowed per second +##! Rate limit HTTP requests to a single domain, maximum burst allowed per second # gitlab_pages['rate_limit_domain_burst'] = 10000 @@ -1743,5 +1745,14 @@ # gitlab_pages['rate_limit_domain_burst'] = 10000 +##! Rate limit new TLS connections per second from a single IP, 0 means is disabled +# gitlab_pages['rate_limit_tls_source_ip'] = 50.0 +##! Rate limit new TLS connections from a single IP, maximum burst allowed per second +# gitlab_pages['rate_limit_tls_source_ip_burst'] = 600 +##!Rate limit new TLS connections per second from to a single domain, 0 means is disabled +# gitlab_pages['rate_limit_tls_domain'] = 0 +##! Rate limit new TLS connections to a single domain, maximum burst allowed per second +# gitlab_pages['rate_limit_tls_domain_burst'] = 10000 + # gitlab_pages['env_directory'] = "/opt/gitlab/etc/gitlab-pages/env" # gitlab_pages['env'] = { # 'SSL_CERT_DIR' => "#{node['package']['install-dir']}/embedded/ssl/certs/" diff --git a/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb b/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb index ddb5807b53535db93242accdd219ee682e3e833c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvYXR0cmlidXRlcy9kZWZhdWx0LnJi..e17e28e65f0e5a21eff03ba6a9c2b9ecc0dd8610_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb @@ -63,3 +63,7 @@ default['gitlab-pages']['rate_limit_source_ip_burst'] = nil default['gitlab-pages']['rate_limit_domain'] = nil default['gitlab-pages']['rate_limit_domain_burst'] = nil +default['gitlab-pages']['rate_limit_tls_source_ip'] = nil +default['gitlab-pages']['rate_limit_tls_source_ip_burst'] = nil +default['gitlab-pages']['rate_limit_tls_domain'] = nil +default['gitlab-pages']['rate_limit_tls_domain_burst'] = nil diff --git a/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb b/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb index ddb5807b53535db93242accdd219ee682e3e833c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLXBhZ2VzLWNvbmZpZy5lcmI=..e17e28e65f0e5a21eff03ba6a9c2b9ecc0dd8610_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLXBhZ2VzLWNvbmZpZy5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb +++ b/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb @@ -142,4 +142,16 @@ <%-end -%> <%- if @rate_limit_domain_burst -%> rate-limit-domain-burst=<%= @rate_limit_domain_burst %> +<%-end -%> +<%- if @rate_limit_tls_source_ip -%> +rate-limit-tls-source-ip=<%= @rate_limit_tls_source_ip %> +<%-end -%> +<%- if @rate_limit_tls_source_ip_burst -%> +rate-limit-tls-source-ip-burst=<%= @rate_limit_tls_source_ip_burst %> +<%-end -%> +<%- if @rate_limit_tls_domain -%> +rate-limit-tls-domain=<%= @rate_limit_tls_domain %> +<%-end -%> +<%- if @rate_limit_tls_domain_burst -%> +rate-limit-tls-domain-burst=<%= @rate_limit_tls_domain_burst %> <%-end -%> \ No newline at end of file diff --git a/spec/chef/gitlab-pages/recipes/gitlab-pages_spec.rb b/spec/chef/gitlab-pages/recipes/gitlab-pages_spec.rb index ddb5807b53535db93242accdd219ee682e3e833c_c3BlYy9jaGVmL2dpdGxhYi1wYWdlcy9yZWNpcGVzL2dpdGxhYi1wYWdlc19zcGVjLnJi..e17e28e65f0e5a21eff03ba6a9c2b9ecc0dd8610_c3BlYy9jaGVmL2dpdGxhYi1wYWdlcy9yZWNpcGVzL2dpdGxhYi1wYWdlc19zcGVjLnJi 100644 --- a/spec/chef/gitlab-pages/recipes/gitlab-pages_spec.rb +++ b/spec/chef/gitlab-pages/recipes/gitlab-pages_spec.rb @@ -221,6 +221,10 @@ rate_limit_source_ip_burst: 50, rate_limit_domain: 1000, rate_limit_domain_burst: 10000, + rate_limit_tls_source_ip: 101, + rate_limit_tls_source_ip_burst: 51, + rate_limit_tls_domain: 1001, + rate_limit_tls_domain_burst: 10001, enable_disk: true, env: { GITLAB_CONTINUOUS_PROFILING: "stackdriver?service=gitlab-pages", @@ -280,6 +284,10 @@ rate-limit-source-ip-burst=50 rate-limit-domain=1000 rate-limit-domain-burst=10000 + rate-limit-tls-source-ip=101 + rate-limit-tls-source-ip-burst=51 + rate-limit-tls-domain=1001 + rate-limit-tls-domain-burst=10001 EOS expect(chef_run).to render_file("/var/opt/gitlab/pages/gitlab-pages-config").with_content(expected_content)