From 32081ad8db97bb5a455b60a67e0f496de2b22828 Mon Sep 17 00:00:00 2001 From: Peter Suschlik Date: Wed, 15 Jun 2016 18:58:05 +0200 Subject: [PATCH 1/2] Make nginx's SSL ciphers configurable http://bettercrypto.org/ suggests to restrict `ssl_ciphers`. GitLab allows weaker SSL ciphers due to some Java IDEs. This commit make SSL ciphers configurable via the environment variable `SSL_CIPHERS`. Example in docker-compose.yml: version: '2' ... services: ... gitlab: ... environment: - SSL_CIPHERS=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA --- assets/runtime/config/nginx/gitlab-ssl | 2 +- assets/runtime/env-defaults | 1 + assets/runtime/functions | 3 ++- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/assets/runtime/config/nginx/gitlab-ssl b/assets/runtime/config/nginx/gitlab-ssl index 830b33b4..60ed584d 100644 --- a/assets/runtime/config/nginx/gitlab-ssl +++ b/assets/runtime/config/nginx/gitlab-ssl @@ -55,7 +55,7 @@ server { ssl_client_certificate {{SSL_CA_CERTIFICATES_PATH}}; # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs - ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; + ssl_ciphers "{{SSL_CIPHERS}}"; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; diff --git a/assets/runtime/env-defaults b/assets/runtime/env-defaults index 741ef862..99a2f272 100644 --- a/assets/runtime/env-defaults +++ b/assets/runtime/env-defaults @@ -130,6 +130,7 @@ SSL_CERTIFICATE_PATH=${SSL_CERTIFICATE_PATH:-$GITLAB_DATA_DIR/certs/gitlab.crt} SSL_KEY_PATH=${SSL_KEY_PATH:-$GITLAB_DATA_DIR/certs/gitlab.key} SSL_DHPARAM_PATH=${SSL_DHPARAM_PATH:-$GITLAB_DATA_DIR/certs/dhparam.pem} SSL_VERIFY_CLIENT=${SSL_VERIFY_CLIENT:-off} +SSL_CIPHERS=${SSL_CIPHERS:-'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'} SSL_REGISTRY_KEY_PATH=${SSL_REGISTRY_KEY_PATH:-$GITLAB_DATA_DIR/certs/registry.key} SSL_REGISTRY_CERT_PATH=${SSL_REGISTRY_CERT_PATH:-$GITLAB_DATA_DIR/certs/registry.crt} diff --git a/assets/runtime/functions b/assets/runtime/functions index 673c98ae..508b76da 100644 --- a/assets/runtime/functions +++ b/assets/runtime/functions @@ -851,7 +851,8 @@ nginx_configure_gitlab_ssl() { SSL_KEY_PATH \ SSL_DHPARAM_PATH \ SSL_VERIFY_CLIENT \ - SSL_CA_CERTIFICATES_PATH + SSL_CA_CERTIFICATES_PATH \ + SSL_CIPHERS fi } From adbf0c1bbfad6d99c79cf8b3f35677dbb85d042b Mon Sep 17 00:00:00 2001 From: Peter Suschlik Date: Wed, 15 Jun 2016 20:08:09 +0200 Subject: [PATCH 2/2] Mention SSL_CIPHERS variable in README --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 38a2c40b..376fd096 100644 --- a/README.md +++ b/README.md @@ -842,6 +842,7 @@ Below is the complete list of available options that can be used to customize yo - **SSL_CA_CERTIFICATES_PATH**: List of SSL certificates to trust. Defaults to `/home/git/data/certs/ca.crt`. - **SSL_REGISTRY_KEY_PATH**: Location of the ssl private key for gitlab container registry. Defaults to `/home/git/data/certs/registry.key` - **SSL_REGISTRY_CERT_PATH**: Location of the ssl certificate for the gitlab container registy. Defaults to `/home/git/data/certs/registry.crt` +- **SSL_CIPHERS**: List of supported SSL ciphers: Defaults to `ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4` - **NGINX_WORKERS**: The number of nginx workers to start. Defaults to `1`. - **NGINX_HSTS_ENABLED**: Advanced configuration option for turning off the HSTS configuration. Applicable only when SSL is in use. Defaults to `true`. See [#138](https://github.com/sameersbn/docker-gitlab/issues/138) for use case scenario. - **NGINX_HSTS_MAXAGE**: Advanced configuration option for setting the HSTS max-age in the gitlab nginx vHost configuration. Applicable only when SSL is in use. Defaults to `31536000`.