# HG changeset patch
# User Naman Jagdish Gala <ngala@gitlab.com>
# Date 1722967901 0
#      Tue Aug 06 18:11:41 2024 +0000
# Node ID fd8c82c2734372690a602c9c6686f87e115405e6
# Parent  6ce24587efc59924e4bacc46a4e3bea3cd034bcc
Add rate_limit_bypass_cidrs parameter for Pages

- Allow administrators to set a list of CIDR addresses that
  can bypass the rate limit.

Related: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8649

Changelog: added

diff --git a/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb b/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb
--- a/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab-pages/attributes/default.rb
@@ -71,6 +71,7 @@
 default['gitlab_pages']['rate_limit_tls_source_ip_burst'] = nil
 default['gitlab_pages']['rate_limit_tls_domain'] = nil
 default['gitlab_pages']['rate_limit_tls_domain_burst'] = nil
+default['gitlab_pages']['rate_limit_subnets_allow_list'] = []
 # HTTP Server timeouts
 default['gitlab_pages']['server_read_timeout'] = nil
 default['gitlab_pages']['server_read_header_timeout'] = nil
diff --git a/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb b/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb
--- a/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb
+++ b/files/gitlab-cookbooks/gitlab-pages/templates/default/gitlab-pages-config.erb
@@ -167,6 +167,9 @@
 <%- if @rate_limit_tls_domain_burst -%>
 rate-limit-tls-domain-burst=<%= @rate_limit_tls_domain_burst %>
 <%-end -%>
+<%- unless @rate_limit_subnets_allow_list.empty? -%>
+rate-limit-subnets-allow-list=<%= @rate_limit_subnets_allow_list.join(',') %>
+<%- end -%>
 <%- if @server_read_timeout -%>
 server-read-timeout=<%= @server_read_timeout %>
 <%-end -%>
diff --git a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
--- a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
+++ b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
@@ -285,6 +285,7 @@
             rate_limit_tls_source_ip_burst: 51,
             rate_limit_tls_domain: 1001,
             rate_limit_tls_domain_burst: 10001,
+            rate_limit_subnets_allow_list: ["10.1.1.0/24", "10.1.2.0/24"],
             server_read_timeout: "1m",
             server_read_header_timeout: "2m",
             server_write_timeout: "3m",
@@ -363,6 +364,7 @@
             rate-limit-tls-source-ip-burst=51
             rate-limit-tls-domain=1001
             rate-limit-tls-domain-burst=10001
+            rate-limit-subnets-allow-list=10.1.1.0/24,10.1.2.0/24
             server-read-timeout=1m
             server-read-header-timeout=2m
             server-write-timeout=3m