This commit adds settings for the `storage_options` setting used to
configure AWS server side encryption. Note that only SSE-KMS
(https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html#sse)
is supported; SSE-C is not.

Related merge requests:

1. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/38240
2. https://gitlab.com/gitlab-org/gitlab-workhorse/-/merge_requests/537

Katrin Leinweber authored 4 years ago and Balasankar C committed 4 years ago

Instead of the plaintext version of this file.
This reverts 4b28887b.

'read_only_after_failover' configuration toggle has been removed from
Praefect. This commit removes the configuration toggle from Praefect's
configuration template.

Cron job introduced in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/38086

This reverts merge request !4289

This adds support for the gitlab.yml changes in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/34460. This allows
GitLab to use the Workhorse S3 client with a single credential, enabling
proper MD5 checksums and multipart uploads, and paves the way for
user-specified keys for encrypted buckets.

These changes require
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/35480 to work.

This was missed by !4296. Added and updated for SSL_CERT_DIR.

Robert Marshall authored 4 years ago and Balasankar C committed 4 years ago

- Adds postgresql['hostssl']; defaults to `false`. If set to `true`,
  then `host` type connections will be set as `hostssl` for
  `trust_auth_cidr_addresses` and `md5_auth_cidr_addresses` entries.

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Praefect now supports TLS connections.
Secured listener can be configured by providing
'tls_listen_addr' configuration in combination
with 'tls' section that includes 'certificate_path'
and 'key_path'.
It is an optional configuration and it is not used
by default.

Closes: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5446

Hossein Pursultani authored 4 years ago and DJ Mountney committed 4 years ago

This also includes Psycopg2 which is required by both patroni service
and patronictl commands.

Jason Young authored 4 years ago and Achilleas Pipinellis committed 4 years ago

While the workhorse source version still defaults to text - the Omnibus default for gitlab-workhorse changed to json as part of 12.0 - see https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/3292

With fallback behavior.

Borrowed from https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4289, thanks to @JonathonReinhart

Now Praefect has the ability to disable mutation on repositories when
these are out of date and failover happens, data loss should not happen
anymore.

As such, this will now be the default, after: https://gitlab.com/gitlab-org/gitaly/-/merge_requests/2218

This change updates the omnibus defaults to reflect this, but is not
blocked on the upstream merge request.

Robert Marshall authored 4 years ago and Balasankar C committed 4 years ago

- The `gitlab.rb` template should show puma as the new default

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5381



Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Configuration 'postgres_queue_enabled' for praefect service
is not needed anymore as it is made enabled by default.

Closes: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5367

Allows enabling Praefect's read-only mode after a failover through
gitlab.rb.

Ian Baum authored 4 years ago and DJ Mountney committed 4 years ago

* This was renamed upstream

* Include `text/html` missing from gzip_types.
* Use the same nginx settings for nginx.conf and gitlab-http.conf.
* Include gzip_ratio in the nginx log format.

https://gitlab.com/gitlab-org/gitlab-foss/-/issues/33719



Signed-off-by: Ben Kochie <bjk@gitlab.com>

We also document some missing praefect and gitaly attributes

Balasankar C authored 4 years ago and DJ Mountney committed 4 years ago

Signed-off-by: Balasankar "Balu" C <balasankarc@autistici.org>

Jason Goodman authored 4 years ago and Balasankar C committed 4 years ago

Indicate settings are for internal GitLab use

This is the next step in having a single way of running Sidekiq: the
sidekiq config now delegates to sidekiq-cluster by default.

It also updates the shutdown timeout and the max threads to the
defaults for sidekiq-cluster and sidekiq

This also adds support for configuring `sidekiq['shutdown_timeout']`.

This secret is RSA private key used to sign CI_JOB_JWT. The key can be
provided with `gitlab-secrets.json` or `gitlab.rb`, and will be
generated if not provided.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/214607