Skip to content
Snippets Groups Projects
Commit e8730ae7865c authored by Stan Hu's avatar Stan Hu
Browse files

Add Puma config support for SSL

To encrypt communication between Workhorse and Puma, some environments
may want to enable encryption on Puma.

Sample config:

```
puma['ssl_listen'] = "127.0.0.1"
puma['ssl_port'] = 9111
puma['ssl_certificate'] = '/path/to/readable-certs/internal.example.crt'
puma['ssl_certificate_key'] = '/path/to/readable-certs/gitlab.example.key'
```

Note that the Puma user (`git`) MUST have permission to read the
certificate and keys. `/etc/gitlab/ssl` is normally not readable by
this user. Unlike NGINX, Puma does not initially run as the root user
and then fork workers with a less privileged user.

If SSL is enabled for Puma, we configure Workhorse to use it
automatically as the Workhorse `authBackend`. `authSocket` will be
disabled by default once SSL is enabled on Puma.

Since Chef merges the defaults with `nil` values, the Puma default
values will always take precedence. Now users can disable this by
setting blank strings:

```
puma['listen'] = ""
puma['socket'] = ""
```

Related https://gitlab.com/gitlab-org/gitlab/-/issues/353013

Changelog: added
parent d9e659f4f55a
No related branches found
No related tags found
1 merge request!72Intermediate build for testing purposes
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment