Add Puma config support for SSL
To encrypt communication between Workhorse and Puma, some environments may want to enable encryption on Puma. Sample config: ``` puma['ssl_listen'] = "127.0.0.1" puma['ssl_port'] = 9111 puma['ssl_certificate'] = '/path/to/readable-certs/internal.example.crt' puma['ssl_certificate_key'] = '/path/to/readable-certs/gitlab.example.key' ``` Note that the Puma user (`git`) MUST have permission to read the certificate and keys. `/etc/gitlab/ssl` is normally not readable by this user. Unlike NGINX, Puma does not initially run as the root user and then fork workers with a less privileged user. If SSL is enabled for Puma, we configure Workhorse to use it automatically as the Workhorse `authBackend`. `authSocket` will be disabled by default once SSL is enabled on Puma. Since Chef merges the defaults with `nil` values, the Puma default values will always take precedence. Now users can disable this by setting blank strings: ``` puma['listen'] = "" puma['socket'] = "" ``` Related https://gitlab.com/gitlab-org/gitlab/-/issues/353013 Changelog: added
parent
d9e659f4f55a
No related branches found
No related tags found
Showing
- files/gitlab-config-template/gitlab.rb.template 9 additions, 0 deletionsfiles/gitlab-config-template/gitlab.rb.template
- files/gitlab-cookbooks/gitlab/attributes/default.rb 8 additions, 0 deletionsfiles/gitlab-cookbooks/gitlab/attributes/default.rb
- files/gitlab-cookbooks/gitlab/libraries/puma.rb 31 additions, 2 deletionsfiles/gitlab-cookbooks/gitlab/libraries/puma.rb
- files/gitlab-cookbooks/gitlab/recipes/puma.rb 27 additions, 7 deletionsfiles/gitlab-cookbooks/gitlab/recipes/puma.rb
- files/gitlab-cookbooks/gitlab/resources/puma_config.rb 7 additions, 0 deletionsfiles/gitlab-cookbooks/gitlab/resources/puma_config.rb
- files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb 21 additions, 1 deletionfiles/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb
- spec/chef/cookbooks/gitlab/recipes/puma_spec.rb 119 additions, 1 deletionspec/chef/cookbooks/gitlab/recipes/puma_spec.rb
Loading
Please register or sign in to comment