This commit adds settings for the `storage_options` setting used to
configure AWS server side encryption. Note that only SSE-KMS
(https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html#sse)
is supported; SSE-C is not.

Related merge requests:

1. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/38240
2. https://gitlab.com/gitlab-org/gitlab-workhorse/-/merge_requests/537

Cron job introduced in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/38086

This also moves the worker pool size setting to an ENV variable
since that was changed in gitlab-rails

This adds support for the gitlab.yml changes in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/34460. This allows
GitLab to use the Workhorse S3 client with a single credential, enabling
proper MD5 checksums and multipart uploads, and paves the way for
user-specified keys for encrypted buckets.

These changes require
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/35480 to work.

Balasankar C authored 4 years ago and DJ Mountney committed 4 years ago

Signed-off-by: Balasankar "Balu" C <balasankarc@autistici.org>

Jan Provaznik authored 4 years ago and Balasankar C committed 4 years ago

When enabled it allows to fetch incoming service desk emails
from a dedicated email address.

Diego Louzán authored 4 years ago and DJ Mountney committed 4 years ago

Related https://gitlab.com/gitlab-org/gitlab/-/merge_requests/29352

The application reads `Settings.gitlab.max_request_duration_seconds`

This option lets the rails app know how much time it has to process a
request. And make decisions accordingly.

By default the time is 90% of the timeout configured for the
worker. This gives us some time during the request to clean up if we
need to.

Setting a duration higher than the worker timeout will raise an error.

Charlie Ablett authored 5 years ago and Balasankar C committed 5 years ago

- Add structured logging file name
- Attempt at test

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Introduce `gitlab_rails['rack_attack_admin_area_protected_paths']` to
manage this GitLab Rails config setting:

`Gitlab.config.rack_attack.admin_area_protected_paths`

This moves the `exporter_blackout_seconds`
to `shutdown_blackout_seconds`.

This is aligned with:
https://gitlab.com/gitlab-org/gitlab/merge_requests/19441

Jason Goodman authored 5 years ago and Balasankar C committed 5 years ago

Add spec for default value of unleash enabled variable

See omnibus-gitlab/merge_requests/3444#note_194217889 for details.

Related to https://gitlab.com/groups/gitlab-org/-/epics/1316.

CE MR: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/30644

https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/14975 added
support for enabling the nonce-based `Content-Security-Type` headers,
which can significantly reduce JavaScript cross-site scripting (XSS)
attacks.

Currently this is not on by default because misconfiguring it
could potentially break loading of JavaScript. Users can configure
the `report_only` and `report_uri` values to report CSP violations
before they enable it completely.

In the future, we hope to generate reasonable defaults
(https://gitlab.com/gitlab-org/gitlab-ce/issues/65675) so that
GitLab will be secured by default.