mirror of
https://github.com/sameersbn/docker-gitlab.git
synced 2025-12-08 17:36:24 +00:00
1507 lines
66 KiB
YAML
1507 lines
66 KiB
YAML
# # # # # # # # # # # # # # # # # #
|
|
# GitLab application config file #
|
|
# # # # # # # # # # # # # # # # # #
|
|
#
|
|
########################### NOTE #####################################
|
|
# This file should not receive new settings. All configuration options #
|
|
# * are being moved to ApplicationSetting model! #
|
|
# If a setting requires an application restart say so in that screen. #
|
|
# If you change this file in a Merge Request, please also create #
|
|
# a MR on https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests. #
|
|
# For more details see https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/gitlab.yml.md #
|
|
########################################################################
|
|
#
|
|
#
|
|
# How to use:
|
|
# 1. Copy file as gitlab.yml
|
|
# 2. Update gitlab -> host with your fully qualified domain name
|
|
# 3. Update gitlab -> email_from
|
|
# 4. If you installed Git from source, change git -> bin_path to /usr/local/bin/git
|
|
# IMPORTANT: If Git was installed in a different location use that instead.
|
|
# You can check with `which git`. If a wrong path of Git is specified, it will
|
|
# result in various issues such as failures of GitLab CI builds.
|
|
# 5. Review this configuration file for other settings you may want to adjust
|
|
|
|
production: &base
|
|
#
|
|
# 1. GitLab app settings
|
|
# ==========================
|
|
|
|
## GitLab settings
|
|
gitlab:
|
|
## Web server settings (note: host is the FQDN, do not include http://)
|
|
host: {{GITLAB_HOST}}
|
|
port: {{GITLAB_PORT}} # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
|
|
https: {{GITLAB_HTTPS}} # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
|
|
# The maximum time unicorn/puma can spend on the request. This needs to be smaller than the worker timeout.
|
|
# Default is 95% of the worker timeout
|
|
max_request_duration_seconds: 57
|
|
|
|
# Uncomment this line below if your ssh host is different from HTTP/HTTPS one
|
|
# (you'd obviously need to replace ssh.host_example.com with your own host).
|
|
# Otherwise, ssh host will be set to the `host:` value above
|
|
ssh_host: {{GITLAB_SSH_HOST}}
|
|
|
|
# Relative URL support
|
|
# WARNING: We recommend using an FQDN to host GitLab in a root path instead
|
|
# of using a relative URL.
|
|
# Documentation: http://doc.gitlab.com/ce/install/relative_url.html
|
|
# Uncomment and customize the following line to run in a non-root path
|
|
#
|
|
relative_url_root: {{GITLAB_RELATIVE_URL_ROOT}}
|
|
|
|
# Content Security Policy
|
|
# See https://guides.rubyonrails.org/security.html#content-security-policy
|
|
content_security_policy:
|
|
enabled: {{GITLAB_CONTENT_SECURITY_POLICY_ENABLED}}
|
|
report_only: {{GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY}}
|
|
directives:
|
|
base_uri: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI}}"
|
|
child_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC}}"
|
|
connect_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC}}"
|
|
default_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC}}"
|
|
font_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC}}"
|
|
form_action: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION}}"
|
|
frame_ancestors: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS}}"
|
|
frame_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC}}"
|
|
img_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC}}"
|
|
manifest_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC}}"
|
|
media_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC}}"
|
|
object_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC}}"
|
|
script_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC}}"
|
|
style_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC}}"
|
|
worker_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC}}"
|
|
report_uri: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI}}"
|
|
|
|
# Trusted Proxies
|
|
# Customize if you have GitLab behind a reverse proxy which is running on a different machine.
|
|
# Add the IP address for your reverse proxy to the list, otherwise users will appear signed in from that address.
|
|
trusted_proxies:
|
|
- {{GITLAB_TRUSTED_PROXIES}}
|
|
# Examples:
|
|
#- 192.168.1.0/24
|
|
#- 192.168.2.1
|
|
#- 2001:0db8::/32
|
|
|
|
# Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
|
|
# user: git
|
|
|
|
## Date & Time settings
|
|
# Uncomment and customize if you want to change the default time zone of GitLab application.
|
|
# To see all available zones, run `bundle exec rake time:zones:all RAILS_ENV=production`
|
|
time_zone: '{{GITLAB_TIMEZONE}}'
|
|
|
|
## Email settings
|
|
# Uncomment and set to false if you need to disable email sending from GitLab (default: true)
|
|
email_enabled: {{GITLAB_EMAIL_ENABLED}}
|
|
# Email address used in the "From" field in mails sent by GitLab
|
|
email_from: {{GITLAB_EMAIL}}
|
|
email_display_name: {{GITLAB_EMAIL_DISPLAY_NAME}}
|
|
email_reply_to: {{GITLAB_EMAIL_REPLY_TO}}
|
|
email_subject_suffix: '{{GITLAB_EMAIL_SUBJECT_SUFFIX}}'
|
|
#start-email-smime
|
|
email_smime:
|
|
# Uncomment and set to true if you need to enable email S/MIME signing (default: false)
|
|
enabled: {{GITLAB_EMAIL_SMIME_ENABLE}}
|
|
# S/MIME private key file in PEM format, unencrypted
|
|
# Default is '.gitlab_smime_key' relative to Rails.root (i.e. root of the GitLab app).
|
|
key_file: {{GITLAB_EMAIL_SMIME_KEY_FILE}}
|
|
# S/MIME public certificate key in PEM format, will be attached to signed messages
|
|
# Default is '.gitlab_smime_cert' relative to Rails.root (i.e. root of the GitLab app).
|
|
cert_file: {{GITLAB_EMAIL_SMIME_CERT_FILE}}
|
|
#end-email-smime
|
|
# S/MIME extra CA public certificates in PEM format, will be attached to signed messages
|
|
# Optional
|
|
# ca_certs_file: /home/git/gitlab/.gitlab_smime_ca_certs
|
|
|
|
# Email server smtp settings are in config/initializers/smtp_settings.rb.sample
|
|
|
|
default_projects_limit: {{GITLAB_PROJECTS_LIMIT}}
|
|
default_can_create_group: {{GITLAB_CREATE_GROUP}} # default: true
|
|
username_changing_enabled: {{GITLAB_USERNAME_CHANGE}} # default: true - User can change their username/namespace
|
|
signup_enabled: {{GITLAB_SIGNUP_ENABLED}}
|
|
## Default theme ID
|
|
## 1 - Indigo
|
|
## 2 - Dark
|
|
## 3 - Light
|
|
## 4 - Blue
|
|
## 5 - Green
|
|
## 6 - Light Indigo
|
|
## 7 - Light Blue
|
|
## 8 - Light Green
|
|
## 9 - Red
|
|
## 10 - Light Red
|
|
default_theme: {{GITLAB_DEFAULT_THEME}} # default: 1
|
|
|
|
## Automatic issue closing
|
|
# If a commit message matches this regular expression, all issues referenced from the matched text will be closed.
|
|
# This happens when the commit is pushed or merged into the default branch of a project.
|
|
# When not specified the default issue_closing_pattern as specified below will be used.
|
|
# Tip: you can test your closing pattern at http://rubular.com.
|
|
issue_closing_pattern: '{{GITLAB_ISSUE_CLOSING_PATTERN}}'
|
|
|
|
## Default project features settings
|
|
default_projects_features:
|
|
issues: {{GITLAB_PROJECTS_ISSUES}}
|
|
merge_requests: {{GITLAB_PROJECTS_MERGE_REQUESTS}}
|
|
wiki: {{GITLAB_PROJECTS_WIKI}}
|
|
snippets: {{GITLAB_PROJECTS_SNIPPETS}}
|
|
builds: {{GITLAB_PROJECTS_BUILDS}}
|
|
container_registry: {{GITLAB_PROJECTS_CONTAINER_REGISTRY}}
|
|
|
|
## Webhook settings
|
|
# Number of seconds to wait for HTTP response after sending webhook HTTP POST request (default: 10)
|
|
webhook_timeout: {{GITLAB_WEBHOOK_TIMEOUT}}
|
|
|
|
### GraphQL Settings
|
|
# Tells the rails application how long it has to complete a GraphQL request.
|
|
# We suggest this value to be higher than the database timeout value
|
|
# and lower than the worker timeout set in unicorn/puma. (default: 30)
|
|
# graphql_timeout: 30
|
|
|
|
## Repository downloads directory
|
|
# When a user clicks e.g. 'Download zip' on a project, a temporary zip file is created in the following directory.
|
|
# The default is 'shared/cache/archive/' relative to the root of the Rails app.
|
|
repository_downloads_path: {{GITLAB_DOWNLOADS_DIR}}
|
|
|
|
## Impersonation settings
|
|
impersonation_enabled: {{GITLAB_IMPERSONATION_ENABLED}}
|
|
|
|
## Disable jQuery and CSS animations
|
|
# disable_animations: true
|
|
|
|
## Reply by email
|
|
# Allow users to comment on issues and merge requests by replying to notification emails.
|
|
# For documentation on how to set this up, see http://doc.gitlab.com/ce/administration/reply_by_email.html
|
|
incoming_email:
|
|
enabled: {{GITLAB_INCOMING_EMAIL_ENABLED}}
|
|
|
|
# The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
|
|
# The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
|
|
# Please be aware that a placeholder is required for the Service Desk feature to work.
|
|
address: "{{GITLAB_INCOMING_EMAIL_ADDRESS}}"
|
|
|
|
# Email account username
|
|
# With third party providers, this is usually the full email address.
|
|
# With self-hosted email servers, this is usually the user part of the email address.
|
|
user: "{{IMAP_USER}}"
|
|
# Email account password
|
|
password: "{{IMAP_PASS}}"
|
|
|
|
# IMAP server host
|
|
host: "{{IMAP_HOST}}"
|
|
# IMAP server port
|
|
port: {{IMAP_PORT}}
|
|
# Whether the IMAP server uses SSL
|
|
ssl: {{IMAP_SSL}}
|
|
# Whether the IMAP server uses StartTLS
|
|
start_tls: {{IMAP_STARTTLS}}
|
|
|
|
# The mailbox where incoming mail will end up. Usually "inbox".
|
|
mailbox: "{{IMAP_MAILBOX}}"
|
|
|
|
# The IDLE command timeout.
|
|
idle_timeout: {{IMAP_TIMEOUT}}
|
|
# The log file path for the structured log file.
|
|
# Since `mail_room` is run independently of Rails, an absolute path is preferred.
|
|
# The default is 'log/mail_room_json.log' relative to the root of the Rails app.
|
|
#
|
|
# log_path: log/mail_room_json.log
|
|
|
|
# Whether to expunge (permanently remove) messages from the mailbox when they are deleted after delivery
|
|
expunge_deleted: false
|
|
|
|
## Build Artifacts
|
|
artifacts:
|
|
enabled: {{GITLAB_ARTIFACTS_ENABLED}}
|
|
# The location where build artifacts are stored (default: shared/artifacts).
|
|
path: {{GITLAB_ARTIFACTS_DIR}}
|
|
object_store:
|
|
enabled: {{GITLAB_ARTIFACTS_OBJECT_STORE_ENABLED}}
|
|
remote_directory: {{GITLAB_ARTIFACTS_OBJECT_STORE_REMOTE_DIRECTORY}} # The bucket name
|
|
direct_upload: {{GITLAB_ARTIFACTS_OBJECT_STORE_DIRECT_UPLOAD}} # Set to true to enable direct upload of Artifacts without the need of local shared storage.
|
|
background_upload: {{GITLAB_ARTIFACTS_OBJECT_STORE_BACKGROUND_UPLOAD}} # Temporary option to limit automatic upload (Default: true)
|
|
proxy_download: {{GITLAB_ARTIFACTS_OBJECT_STORE_PROXY_DOWNLOAD}} # Passthrough all downloads via GitLab instead of using Redirects to Object Storage
|
|
connection:
|
|
provider: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_PROVIDER}} # Only AWS supported at the moment
|
|
#start-artifacts-aws
|
|
aws_access_key_id: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_SECRET_ACCESS_KEY}}
|
|
region: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_REGION}}
|
|
host: '{{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_HOST}}' # default: s3.amazonaws.com
|
|
aws_signature_version: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_SIGNATURE_VERSION}} # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
endpoint: '{{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_ENDPOINT}}' # default: nil - Useful for S3 compliant services such as DigitalOcean Spaces
|
|
path_style: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_AWS_PATH_STYLE}} # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
#end-artifacts-aws
|
|
#start-artifacts-gcs
|
|
google_project: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_GOOGLE_PROJECT}}
|
|
google_client_email: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_GOOGLE_CLIENT_EMAIL}}
|
|
google_json_key_location: {{GITLAB_ARTIFACTS_OBJECT_STORE_CONNECTION_GOOGLE_JSON_KEY_LOCATION}}
|
|
#end-artifacts-gcs
|
|
|
|
## Merge request external diff storage
|
|
external_diffs:
|
|
# If disabled (the default), the diffs are in-database. Otherwise, they can
|
|
# be stored on disk, or in object storage
|
|
enabled: false
|
|
# The location where external diffs are stored (default: shared/lfs-external-diffs).
|
|
# storage_path: shared/external-diffs
|
|
# object_store:
|
|
# enabled: false
|
|
# remote_directory: external-diffs
|
|
# background_upload: false
|
|
# proxy_download: false
|
|
# connection:
|
|
# provider: AWS
|
|
# aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
# aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
# region: us-east-1
|
|
|
|
## Git LFS
|
|
lfs:
|
|
enabled: {{GITLAB_LFS_ENABLED}}
|
|
# The location where LFS objects are stored (default: shared/lfs-objects).
|
|
storage_path: {{GITLAB_LFS_OBJECTS_DIR}}
|
|
object_store:
|
|
enabled: {{GITLAB_LFS_OBJECT_STORE_ENABLED}}
|
|
remote_directory: {{GITLAB_LFS_OBJECT_STORE_REMOTE_DIRECTORY}} # Bucket name
|
|
direct_upload: {{GITLAB_LFS_OBJECT_STORE_DIRECT_UPLOAD}} # Use Object Storage directly for uploads instead of background uploads if enabled (Default: false)
|
|
background_upload: {{GITLAB_LFS_OBJECT_STORE_BACKGROUND_UPLOAD}} # Temporary option to limit automatic upload (Default: true)
|
|
proxy_download: {{GITLAB_LFS_OBJECT_STORE_PROXY_DOWNLOAD}} # Passthrough all downloads via GitLab instead of using Redirects to Object Storage
|
|
connection:
|
|
provider: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_PROVIDER}}
|
|
#start-lfs-aws
|
|
aws_access_key_id: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_SECRET_ACCESS_KEY}}
|
|
aws_signature_version: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_SIGNATURE_VERSION}} # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
region: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_REGION}}
|
|
host: '{{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_HOST}}' # default: s3.amazonaws.com
|
|
endpoint: '{{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_ENDPOINT}}' # default: nil
|
|
path_style: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_AWS_PATH_STYLE}} # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
#end-lfs-aws
|
|
#start-lfs-gcs
|
|
google_project: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_GOOGLE_PROJECT}}
|
|
google_client_email: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_GOOGLE_CLIENT_EMAIL}}
|
|
google_json_key_location: {{GITLAB_LFS_OBJECT_STORE_CONNECTION_GOOGLE_JSON_KEY_LOCATION}}
|
|
#end-lfs-gcs
|
|
|
|
# Use the following options to configure an AWS compatible host
|
|
# host: 'localhost' # default: s3.amazonaws.com
|
|
# endpoint: 'http://127.0.0.1:9000' # default: nil
|
|
# aws_signature_version: 4 # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
# path_style: true # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
|
|
## Uploads (attachments, avatars, etc...)
|
|
uploads:
|
|
# The location where uploads objects are stored (default: public/).
|
|
storage_path: {{GITLAB_UPLOADS_STORAGE_PATH}}
|
|
base_dir: {{GITLAB_UPLOADS_BASE_DIR}}
|
|
object_store:
|
|
enabled: {{GITLAB_UPLOADS_OBJECT_STORE_ENABLED}}
|
|
remote_directory: {{GITLAB_UPLOADS_OBJECT_STORE_REMOTE_DIRECTORY}} # Bucket name
|
|
direct_upload: {{GITLAB_UPLOADS_OBJECT_STORE_DIRECT_UPLOAD}} # Use Object Storage directly for uploads instead of background uploads if enabled (Default: false)
|
|
background_upload: {{GITLAB_UPLOADS_OBJECT_STORE_BACKGROUND_UPLOAD}} # Temporary option to limit automatic upload (Default: true)
|
|
proxy_download: {{GITLAB_UPLOADS_OBJECT_STORE_PROXY_DOWNLOAD}} # Passthrough all downloads via GitLab instead of using Redirects to Object Storage
|
|
connection:
|
|
provider: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_PROVIDER}}
|
|
#start-uploads-aws
|
|
aws_access_key_id: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_SECRET_ACCESS_KEY}}
|
|
aws_signature_version: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_SIGNATURE_VERSION}} # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
region: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_REGION}}
|
|
host: '{{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_HOST}}' # default: s3.amazonaws.com
|
|
endpoint: '{{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_ENDPOINT}}' # default: nil
|
|
path_style: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_AWS_PATH_STYLE}} # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
#end-uploads-aws
|
|
#start-uploads-gcs
|
|
google_project: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_GOOGLE_PROJECT}}
|
|
google_client_email: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_GOOGLE_CLIENT_EMAIL}}
|
|
google_json_key_location: {{GITLAB_UPLOADS_OBJECT_STORE_CONNECTION_GOOGLE_JSON_KEY_LOCATION}}
|
|
#end-uploads-gcs
|
|
|
|
## Packages (maven repository, npm registry, etc...)
|
|
packages:
|
|
enabled: {{GITLAB_PACKAGES_ENABLED}}
|
|
# The location where build packages are stored (default: shared/packages).
|
|
path: {{GITLAB_PACKAGES_DIR}}
|
|
object_store:
|
|
enabled: {{GITLAB_PACKAGES_OBJECT_STORE_ENABLED}}
|
|
remote_directory: {{GITLAB_PACKAGES_OBJECT_STORE_REMOTE_DIRECTORY}} # The bucket name
|
|
direct_upload: {{GITLAB_PACKAGES_OBJECT_STORE_DIRECT_UPLOAD}} # Set to true to enable direct upload of Packages without the need of local shared storage.
|
|
background_upload: {{GITLAB_PACKAGES_OBJECT_STORE_BACKGROUND_UPLOAD}} # Temporary option to limit automatic upload (Default: true)
|
|
proxy_download: {{GITLAB_PACKAGES_OBJECT_STORE_PROXY_DOWNLOAD}} # Passthrough all downloads via GitLab instead of using Redirects to Object Storage
|
|
connection:
|
|
provider: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_PROVIDER}} # Only AWS supported at the moment
|
|
#start-packages-aws
|
|
aws_access_key_id: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_SECRET_ACCESS_KEY}}
|
|
region: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_REGION}}
|
|
host: '{{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_HOST}}' # default: s3.amazonaws.com
|
|
aws_signature_version: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_SIGNATURE_VERSION}} # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
endpoint: '{{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_ENDPOINT}}' # default: nil - Useful for S3 compliant services such as DigitalOcean Spaces
|
|
path_style: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_AWS_PATH_STYLE}} # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
#end-packages-aws
|
|
#start-packages-gcs
|
|
google_project: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_GOOGLE_PROJECT}}
|
|
google_client_email: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_GOOGLE_CLIENT_EMAIL}}
|
|
google_json_key_location: {{GITLAB_PACKAGES_OBJECT_STORE_CONNECTION_GOOGLE_JSON_KEY_LOCATION}}
|
|
#end-packages-gcs
|
|
|
|
|
|
## Dependency Proxy
|
|
dependency_proxy:
|
|
enabled: true
|
|
# The location where build packages are stored (default: shared/dependency_proxy).
|
|
# storage_path: shared/dependency_proxy
|
|
object_store:
|
|
enabled: false
|
|
remote_directory: dependency_proxy # The bucket name
|
|
# direct_upload: false # Use Object Storage directly for uploads instead of background uploads if enabled (Default: false)
|
|
# background_upload: false # Temporary option to limit automatic upload (Default: true)
|
|
# proxy_download: false # Passthrough all downloads via GitLab instead of using Redirects to Object Storage
|
|
connection:
|
|
provider: AWS
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
# host: 'localhost' # default: s3.amazonaws.com
|
|
# endpoint: 'http://127.0.0.1:9000' # default: nil
|
|
# aws_signature_version: 4 # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
# path_style: true # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
|
|
## Terraform state
|
|
terraform_state:
|
|
enabled: {{GITLAB_TERRAFORM_STATE_ENABLED}}
|
|
# The location where Terraform state files are stored (default: shared/terraform_state).
|
|
storage_path: {{GITLAB_TERRAFORM_STATE_STORAGE_PATH}}
|
|
object_store:
|
|
enabled: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_ENABLED}}
|
|
remote_directory: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_REMOTE_DIRECTORY}} # The bucket name
|
|
connection:
|
|
provider: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_PROVIDER}}
|
|
#start-terraform_state-aws
|
|
aws_access_key_id: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_SECRET_ACCESS_KEY}}
|
|
region: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_REGION}}
|
|
host: '{{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_HOST}}' # default: s3.amazonaws.com
|
|
endpoint: '{{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_ENDPOINT}}' # default: nil
|
|
aws_signature_version: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_SIGNATURE_VERSION}} # For creation of signed URLs. Set to 2 if provider does not support v4.
|
|
path_style: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_AWS_PATH_STYLE}} # Use 'host/bucket_name/object' instead of 'bucket_name.host/object'
|
|
#end-terraform_state-aws
|
|
#start-terraform_state-gcs
|
|
google_project: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_GOOGLE_PROJECT}}
|
|
google_client_email: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_GOOGLE_CLIENT_EMAIL}}
|
|
google_json_key_location: {{GITLAB_TERRAFORM_STATE_OBJECT_STORE_CONNECTION_GOOGLE_JSON_KEY_LOCATION}}
|
|
#end-terraform_state-gcs
|
|
|
|
## GitLab Pages
|
|
pages:
|
|
enabled: {{GITLAB_PAGES_ENABLED}}
|
|
access_control: {{GITLAB_PAGES_ACCESS_CONTROL}}
|
|
# The location where pages are stored (default: shared/pages).
|
|
# path: shared/pages
|
|
|
|
# The domain under which the pages are served:
|
|
# http://group.example.com/project
|
|
# or project path can be a group page: group.example.com
|
|
host: {{GITLAB_PAGES_DOMAIN}}
|
|
port: {{GITLAB_PAGES_PORT}} # Set to 443 if you serve the pages with HTTPS
|
|
https: {{GITLAB_PAGES_HTTPS}} # Set to true if you serve the pages with HTTPS
|
|
artifacts_server: {{GITLAB_PAGES_ARTIFACTS_SERVER}} # Set to false if you want to disable online view of HTML artifacts
|
|
external_http: {{GITLAB_PAGES_EXTERNAL_HTTP}} # If defined, enables custom domain support in GitLab Pages
|
|
external_https: {{GITLAB_PAGES_EXTERNAL_HTTPS}} # If defined, enables custom domain and certificate support in GitLab Pages
|
|
|
|
# File that contains the shared secret key for verifying access for gitlab-pages.
|
|
# Default is '.gitlab_pages_secret' relative to Rails.root (i.e. root of the GitLab app).
|
|
# secret_file: /home/git/gitlab/.gitlab_pages_secret
|
|
|
|
## Mattermost
|
|
## For enabling Add to Mattermost button
|
|
mattermost:
|
|
enabled: {{GITLAB_MATTERMOST_ENABLED}}
|
|
host: '{{GITLAB_MATTERMOST_URL}}'
|
|
|
|
## Gravatar
|
|
## If using gravatar.com, there's nothing to change here. For Libravatar
|
|
## you'll need to provide the custom URLs. For more information,
|
|
## see: https://docs.gitlab.com/ee/customization/libravatar.html
|
|
gravatar:
|
|
enabled: {{GITLAB_GRAVATAR_ENABLED}}
|
|
# Gravatar/Libravatar URLs: possible placeholders: %{hash} %{size} %{email} %{username}
|
|
plain_url: "{{GITLAB_GRAVATAR_HTTP_URL}}" # default: https://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
|
|
ssl_url: "{{GITLAB_GRAVATAR_HTTPS_URL}}" # default: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
|
|
|
|
## Sidekiq
|
|
sidekiq:
|
|
log_format: {{GITLAB_SIDEKIQ_LOG_FORMAT}} # (default is the original format)
|
|
|
|
## Auxiliary jobs
|
|
# Periodically executed jobs, to self-heal GitLab, do external synchronizations, etc.
|
|
# Please read here for more information: https://github.com/ondrejbartas/sidekiq-cron#adding-cron-job
|
|
cron_jobs:
|
|
# Flag stuck CI jobs as failed
|
|
stuck_ci_jobs_worker:
|
|
cron: "0 * * * *"
|
|
# Execute scheduled triggers
|
|
pipeline_schedule_worker:
|
|
cron: "{{GITLAB_PIPELINE_SCHEDULE_WORKER_CRON}}"
|
|
# Remove expired build artifacts
|
|
expire_build_artifacts_worker:
|
|
cron: "50 * * * *"
|
|
# Stop expired environments
|
|
environments_auto_stop_cron_worker:
|
|
cron: "24 * * * *"
|
|
# Periodically run 'git fsck' on all repositories. If started more than
|
|
# once per hour you will have concurrent 'git fsck' jobs.
|
|
repository_check_worker:
|
|
cron: "20 * * * *"
|
|
# Archive live traces which have not been archived yet
|
|
ci_archive_traces_cron_worker:
|
|
cron: "17 * * * *"
|
|
# Send admin emails once a week
|
|
admin_email_worker:
|
|
cron: "0 0 * * 0"
|
|
# Send emails for personal tokens which are about to expire
|
|
personal_access_tokens_expiring_worker:
|
|
cron: "0 1 * * *"
|
|
|
|
# Remove outdated repository archives
|
|
repository_archive_cache_worker:
|
|
cron: "0 * * * *"
|
|
|
|
# Verify custom GitLab Pages domains
|
|
pages_domain_verification_cron_worker:
|
|
cron: "*/15 * * * *"
|
|
|
|
# Periodically migrate diffs from the database to external storage
|
|
schedule_migrate_external_diffs_worker:
|
|
cron: "15 * * * *"
|
|
|
|
# GitLab EE only jobs. These jobs are automatically enabled for an EE
|
|
# installation, and ignored for a CE installation.
|
|
ee_cron_jobs:
|
|
# Snapshot active users statistics
|
|
historical_data_worker:
|
|
cron: "0 12 * * *"
|
|
|
|
# In addition to refreshing users when they log in,
|
|
# periodically refresh LDAP users membership.
|
|
# NOTE: This will only take effect if LDAP is enabled
|
|
ldap_sync_worker:
|
|
cron: "30 1 * * *"
|
|
|
|
# Periodically refresh LDAP groups membership.
|
|
# NOTE: This will only take effect if LDAP is enabled
|
|
ldap_group_sync_worker:
|
|
cron: "0 * * * *"
|
|
|
|
# GitLab Geo metrics update worker
|
|
# NOTE: This will only take effect if Geo is enabled
|
|
geo_metrics_update_worker:
|
|
cron: "*/1 * * * *"
|
|
|
|
# GitLab Geo prune event log worker
|
|
# NOTE: This will only take effect if Geo is enabled (primary node only)
|
|
geo_prune_event_log_worker:
|
|
cron: "*/5 * * * *"
|
|
|
|
# GitLab Geo repository sync worker
|
|
# NOTE: This will only take effect if Geo is enabled (secondary nodes only)
|
|
geo_repository_sync_worker:
|
|
cron: "*/1 * * * *"
|
|
|
|
# GitLab Geo registry backfill worker
|
|
# NOTE: This will only take effect if Geo is enabled (secondary nodes only)
|
|
geo_secondary_registry_consistency_worker:
|
|
cron: "* * * * *"
|
|
|
|
# GitLab Geo file download dispatch worker
|
|
# NOTE: This will only take effect if Geo is enabled (secondary nodes only)
|
|
geo_file_download_dispatch_worker:
|
|
cron: "*/1 * * * *"
|
|
|
|
# GitLab Geo migrated local files clean up worker
|
|
# NOTE: This will only take effect if Geo is enabled (secondary nodes only)
|
|
geo_migrated_local_files_clean_up_worker:
|
|
cron: "15 */6 * * *"
|
|
|
|
# Export pseudonymized data in CSV format for analysis
|
|
pseudonymizer_worker:
|
|
cron: "0 * * * *"
|
|
|
|
# Elasticsearch bulk updater for incremental updates.
|
|
# NOTE: This will only take effect if elasticsearch is enabled.
|
|
elastic_index_bulk_cron_worker:
|
|
cron: "*/1 * * * *"
|
|
|
|
registry:
|
|
enabled: {{GITLAB_REGISTRY_ENABLED}}
|
|
host: {{GITLAB_REGISTRY_HOST}}
|
|
port: {{GITLAB_REGISTRY_PORT}}
|
|
api_url: {{GITLAB_REGISTRY_API_URL}} # internal address to the registry, will be used by GitLab to directly communicate with API
|
|
key: {{GITLAB_REGISTRY_KEY_PATH}}
|
|
path: {{GITLAB_REGISTRY_DIR}}
|
|
issuer: {{GITLAB_REGISTRY_ISSUER}}
|
|
# notification_secret: '' # only set it when you use Geo replication feature without built-in Registry
|
|
|
|
# Add notification settings if you plan to use Geo Replication for the registry
|
|
# notifications:
|
|
# - name: geo_event
|
|
# url: https://example.com/api/v4/container_registry_event/events
|
|
# timeout: 2s
|
|
# threshold: 5
|
|
# backoff: 1s
|
|
# headers:
|
|
# Authorization: secret_phrase
|
|
|
|
## Error Reporting and Logging with Sentry
|
|
sentry:
|
|
enabled: {{SENTRY_ENABLED}}
|
|
dsn: {{SENTRY_DSN}}
|
|
clientside_dsn: {{SENTRY_CLIENTSIDE_DSN}}
|
|
environment: '{{SENTRY_ENVIRONMENT}}' # e.g. development, staging, production
|
|
|
|
## Geo
|
|
# NOTE: These settings will only take effect if Geo is enabled
|
|
geo:
|
|
# This is an optional identifier which Geo nodes can use to identify themselves.
|
|
# For example, if external_url is the same for two secondaries, you must specify
|
|
# a unique Geo node name for those secondaries.
|
|
#
|
|
# If it is blank, it defaults to external_url.
|
|
node_name: ''
|
|
|
|
registry_replication:
|
|
# enabled: true
|
|
# primary_api_url: http://localhost:5000/ # internal address to the primary registry, will be used by GitLab to directly communicate with primary registry API
|
|
|
|
## Feature Flag https://docs.gitlab.com/ee/user/project/operations/feature_flags.html
|
|
feature_flags:
|
|
unleash:
|
|
# enabled: false
|
|
# url: https://gitlab.com/api/v4/feature_flags/unleash/<project_id>
|
|
# app_name: gitlab.com # Environment name of your GitLab instance
|
|
# instance_id: INSTANCE_ID
|
|
|
|
#
|
|
# 2. GitLab CI settings
|
|
# ==========================
|
|
|
|
gitlab_ci:
|
|
# Default project notifications settings:
|
|
#
|
|
# Send emails only on broken builds (default: true)
|
|
all_broken_builds: {{GITLAB_NOTIFY_ON_BROKEN_BUILDS}}
|
|
#
|
|
# Add pusher to recipients list (default: false)
|
|
add_pusher: {{GITLAB_NOTIFY_PUSHER}}
|
|
|
|
# The location where build traces are stored (default: builds/). Relative paths are relative to Rails.root
|
|
builds_path: {{GITLAB_BUILDS_DIR}}
|
|
|
|
#
|
|
# 3. Auth settings
|
|
# ==========================
|
|
|
|
## LDAP settings
|
|
# You can test connections and inspect a sample of the LDAP users with login
|
|
# access by running:
|
|
# bundle exec rake gitlab:ldap:check RAILS_ENV=production
|
|
ldap:
|
|
enabled: {{LDAP_ENABLED}}
|
|
prevent_ldap_sign_in: {{LDAP_PREVENT_LDAP_SIGN_IN}}
|
|
|
|
# This setting controls the number of seconds between LDAP permission checks
|
|
# for each user. After this time has expired for a given user, their next
|
|
# interaction with GitLab (a click in the web UI, a git pull, etc.) will be
|
|
# slower because the LDAP permission check is being performed. How much
|
|
# slower depends on your LDAP setup, but it is not uncommon for this check
|
|
# to add seconds of waiting time. The default value is to have a "slow
|
|
# click" once every 3600 seconds (i.e., once per hour).
|
|
#
|
|
# Warning: if you set this value too low, every click in GitLab will be a
|
|
# "slow click" for all of your LDAP users.
|
|
# sync_time: 3600
|
|
|
|
servers:
|
|
##########################################################################
|
|
#
|
|
# Since GitLab 7.4, LDAP servers get ID's (below the ID is 'main'). GitLab
|
|
# Enterprise Edition now supports connecting to multiple LDAP servers.
|
|
#
|
|
# If you are updating from the old (pre-7.4) syntax, you MUST give your
|
|
# old server the ID 'main'.
|
|
#
|
|
##########################################################################
|
|
main: # 'main' is the GitLab 'provider ID' of this LDAP server
|
|
## label
|
|
#
|
|
# A human-friendly name for your LDAP server. It is OK to change the label later,
|
|
# for instance if you find out it is too large to fit on the web page.
|
|
#
|
|
# Example: 'Paris' or 'Acme, Ltd.'
|
|
label: '{{LDAP_LABEL}}'
|
|
|
|
# Example: 'ldap.mydomain.com'
|
|
host: '{{LDAP_HOST}}'
|
|
# This port is an example, it is sometimes different but it is always an integer and not a string
|
|
port: {{LDAP_PORT}} # usually 636 for SSL
|
|
uid: '{{LDAP_UID}}' # This should be the attribute, not the value that maps to uid.
|
|
|
|
# Examples: 'america\\momo' or 'CN=Gitlab Git,CN=Users,DC=mydomain,DC=com'
|
|
bind_dn: '{{LDAP_BIND_DN}}'
|
|
password: '{{LDAP_PASS}}'
|
|
|
|
# Encryption method. The "method" key is deprecated in favor of
|
|
# "encryption".
|
|
#
|
|
# Examples: "start_tls" or "simple_tls" or "plain"
|
|
#
|
|
# Deprecated values: "tls" was replaced with "start_tls" and "ssl" was
|
|
# replaced with "simple_tls".
|
|
#
|
|
encryption: '{{LDAP_METHOD}}'
|
|
|
|
# Enables SSL certificate verification if encryption method is
|
|
# "start_tls" or "simple_tls". Defaults to true.
|
|
verify_certificates: {{LDAP_VERIFY_SSL}}
|
|
|
|
# OpenSSL::SSL::SSLContext options.
|
|
tls_options:
|
|
# Specifies the path to a file containing a PEM-format CA certificate,
|
|
# e.g. if you need to use an internal CA.
|
|
#
|
|
# Example: '/etc/ca.pem'
|
|
#
|
|
ca_file: '{{LDAP_CA_FILE}}'
|
|
|
|
# Specifies the SSL version for OpenSSL to use, if the OpenSSL default
|
|
# is not appropriate.
|
|
#
|
|
# Example: 'TLSv1_1'
|
|
#
|
|
ssl_version: '{{LDAP_SSL_VERSION}}'
|
|
|
|
# Specific SSL ciphers to use in communication with LDAP servers.
|
|
#
|
|
# Example: 'ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2'
|
|
ciphers: ''
|
|
|
|
# Client certificate
|
|
#
|
|
# Example:
|
|
# cert: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIDbDCCAlSgAwIBAgIGAWkJxLmKMA0GCSqGSIb3DQEBCwUAMHcxFDASBgNVBAoTC0dvb2dsZSBJ
|
|
# bmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQDEwtMREFQIENsaWVudDEPMA0GA1UE
|
|
# CxMGR1N1aXRlMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTAeFw0xOTAyMjAwNzE4
|
|
# rntnF4d+0dd7zP3jrWkbdtoqjLDT/5D7NYRmVCD5vizV98FJ5//PIHbD1gL3a9b2MPAc6k7NV8tl
|
|
# ...
|
|
# 4SbuJPAiJxC1LQ0t39dR6oMCAMab3hXQqhL56LrR6cRBp6Mtlphv7alu9xb/x51y2x+g2zWtsf80
|
|
# Jrv/vKMsIh/sAyuogb7hqMtp55ecnKxceg==
|
|
# -----END CERTIFICATE -----
|
|
cert: ''
|
|
|
|
# Client private key
|
|
# key: |
|
|
# -----BEGIN PRIVATE KEY-----
|
|
# MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3DmJtLRmJGY4xU1QtI3yjvxO6
|
|
# bNuyE4z1NF6Xn7VSbcAaQtavWQ6GZi5uukMo+W5DHVtEkgDwh92ySZMuJdJogFbNvJvHAayheCdN
|
|
# 7mCQ2UUT9jGXIbmksUn9QMeJVXTZjgJWJzPXToeUdinx9G7+lpVa62UATEd1gaI3oyL72WmpDy/C
|
|
# rntnF4d+0dd7zP3jrWkbdtoqjLDT/5D7NYRmVCD5vizV98FJ5//PIHbD1gL3a9b2MPAc6k7NV8tl
|
|
# ...
|
|
# +9IhSYX+XIg7BZOVDeYqlPfxRvQh8vy3qjt/KUihmEPioAjLaGiihs1Fk5ctLk9A2hIUyP+sEQv9
|
|
# l6RG+a/mW+0rCWn8JAd464Ps9hE=
|
|
# -----END PRIVATE KEY-----
|
|
key: ''
|
|
|
|
# Set a timeout, in seconds, for LDAP queries. This helps avoid blocking
|
|
# a request if the LDAP server becomes unresponsive.
|
|
# A value of 0 means there is no timeout.
|
|
timeout: {{LDAP_TIMEOUT}}
|
|
|
|
# Enable smartcard authentication against the LDAP server. Valid values
|
|
# are "false", "optional", and "required".
|
|
smartcard_auth: false
|
|
|
|
# This setting specifies if LDAP server is Active Directory LDAP server.
|
|
# For non AD servers it skips the AD specific queries.
|
|
# If your LDAP server is not AD, set this to false.
|
|
active_directory: {{LDAP_ACTIVE_DIRECTORY}}
|
|
|
|
# If allow_username_or_email_login is enabled, GitLab will ignore everything
|
|
# after the first '@' in the LDAP username submitted by the user on login.
|
|
#
|
|
# Example:
|
|
# - the user enters 'jane.doe@example.com' and 'p@ssw0rd' as LDAP credentials;
|
|
# - GitLab queries the LDAP server with 'jane.doe' and 'p@ssw0rd'.
|
|
#
|
|
# If you are using "uid: 'userPrincipalName'" on ActiveDirectory you need to
|
|
# disable this setting, because the userPrincipalName contains an '@'.
|
|
allow_username_or_email_login: {{LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN}}
|
|
|
|
# To maintain tight control over the number of active users on your GitLab installation,
|
|
# enable this setting to keep new users blocked until they have been cleared by the admin
|
|
# (default: false).
|
|
block_auto_created_users: {{LDAP_BLOCK_AUTO_CREATED_USERS}}
|
|
|
|
# Base where we can search for users
|
|
#
|
|
# Ex. 'ou=People,dc=gitlab,dc=example' or 'DC=mydomain,DC=com'
|
|
#
|
|
base: '{{LDAP_BASE}}'
|
|
|
|
# Filter LDAP users
|
|
#
|
|
# Format: RFC 4515 https://tools.ietf.org/search/rfc4515
|
|
# Ex. (employeeType=developer)
|
|
#
|
|
# Note: GitLab does not support omniauth-ldap's custom filter syntax.
|
|
#
|
|
# Example for getting only specific users:
|
|
# '(&(objectclass=user)(|(samaccountname=momo)(samaccountname=toto)))'
|
|
#
|
|
user_filter: '{{LDAP_USER_FILTER}}'
|
|
|
|
# Base where we can search for groups
|
|
#
|
|
# Ex. ou=Groups,dc=gitlab,dc=example
|
|
#
|
|
group_base: ''
|
|
|
|
# LDAP group of users who should be admins in GitLab
|
|
#
|
|
# Ex. GLAdmins
|
|
#
|
|
admin_group: ''
|
|
|
|
# LDAP group of users who should be marked as external users in GitLab
|
|
#
|
|
# Ex. ['Contractors', 'Interns']
|
|
#
|
|
external_groups: []
|
|
|
|
# Name of attribute which holds a ssh public key of the user object.
|
|
# If false or nil, SSH key syncronisation will be disabled.
|
|
#
|
|
# Ex. sshpublickey
|
|
#
|
|
sync_ssh_keys: false
|
|
|
|
# LDAP attributes that GitLab will use to create an account for the LDAP user.
|
|
# The specified attribute can either be the attribute name as a string (e.g. 'mail'),
|
|
# or an array of attribute names to try in order (e.g. ['mail', 'email']).
|
|
# Note that the user's LDAP login will always be the attribute specified as `uid` above.
|
|
attributes:
|
|
# The username will be used in paths for the user's own projects
|
|
# (like `gitlab.example.com/username/project`) and when mentioning
|
|
# them in issues, merge request and comments (like `@username`).
|
|
# If the attribute specified for `username` contains an email address,
|
|
# the GitLab username will be the part of the email address before the '@'.
|
|
username: {{LDAP_USER_ATTRIBUTE_USERNAME}}
|
|
email: {{LDAP_USER_ATTRIBUTE_MAIL}}
|
|
|
|
# If no full name could be found at the attribute specified for `name`,
|
|
# the full name is determined using the attributes specified for
|
|
# `first_name` and `last_name`.
|
|
name: '{{LDAP_USER_ATTRIBUTE_NAME}}'
|
|
first_name: '{{LDAP_USER_ATTRIBUTE_FIRSTNAME}}'
|
|
last_name: '{{LDAP_USER_ATTRIBUTE_LASTNAME}}'
|
|
|
|
# If lowercase_usernames is enabled, GitLab will lower case the username.
|
|
lowercase_usernames: {{LDAP_LOWERCASE_USERNAMES}}
|
|
|
|
# GitLab EE only: add more LDAP servers
|
|
# Choose an ID made of a-z and 0-9 . This ID will be stored in the database
|
|
# so that GitLab can remember which LDAP server a user belongs to.
|
|
# uswest2:
|
|
# label:
|
|
# host:
|
|
# ....
|
|
|
|
## Smartcard authentication settings
|
|
smartcard:
|
|
# Allow smartcard authentication
|
|
enabled: false
|
|
|
|
# Path to a file containing a CA certificate bundle
|
|
ca_file: '/etc/ssl/certs/CA.pem'
|
|
|
|
# Host and port where the client side certificate is requested by the
|
|
# webserver (NGINX/Apache)
|
|
# client_certificate_required_host: smartcard.gitlab.example.com
|
|
# client_certificate_required_port: 3444
|
|
|
|
# Browser session with smartcard sign-in is required for Git access
|
|
# required_for_git_access: false
|
|
|
|
# Use X.509 SAN extensions certificates to identify GitLab users
|
|
# Add a subjectAltName to your certificates like: email:user
|
|
# san_extensions: true
|
|
|
|
## Kerberos settings
|
|
kerberos:
|
|
# Allow the HTTP Negotiate authentication method for Git clients
|
|
enabled: false
|
|
|
|
# Kerberos 5 keytab file. The keytab file must be readable by the GitLab user,
|
|
# and should be different from other keytabs in the system.
|
|
# (default: use default keytab from Krb5 config)
|
|
# keytab: /etc/http.keytab
|
|
|
|
# The Kerberos service name to be used by GitLab.
|
|
# (default: accept any service name in keytab file)
|
|
# service_principal_name: HTTP/gitlab.example.com@EXAMPLE.COM
|
|
|
|
# Dedicated port: Git before 2.4 does not fall back to Basic authentication if Negotiate fails.
|
|
# To support both Basic and Negotiate methods with older versions of Git, configure
|
|
# nginx to proxy GitLab on an extra port (e.g. 8443) and uncomment the following lines
|
|
# to dedicate this port to Kerberos authentication. (default: false)
|
|
# use_dedicated_port: true
|
|
# port: 8443
|
|
# https: true
|
|
|
|
## OmniAuth settings
|
|
omniauth:
|
|
# Allow login via Twitter, Google, etc. using OmniAuth providers
|
|
enabled: {{OAUTH_ENABLED}}
|
|
|
|
# Uncomment this to automatically sign in with a specific omniauth provider's without
|
|
# showing GitLab's sign-in page (default: show the GitLab sign-in page)
|
|
auto_sign_in_with_provider: {{OAUTH_AUTO_SIGN_IN_WITH_PROVIDER}}
|
|
|
|
# Sync user's profile from the specified Omniauth providers every time the user logs in (default: empty).
|
|
# Define the allowed providers using an array, e.g. ["cas3", "saml", "twitter"],
|
|
# or as true/false to allow all providers or none.
|
|
# When authenticating using LDAP, the user's email is always synced.
|
|
# sync_profile_from_provider: []
|
|
|
|
# Select which info to sync from the providers above. (default: email).
|
|
# Define the synced profile info using an array. Available options are "name", "email" and "location"
|
|
# e.g. ["name", "email", "location"] or as true to sync all available.
|
|
# This consequently will make the selected attributes read-only.
|
|
# sync_profile_attributes: true
|
|
|
|
# CAUTION!
|
|
# This allows users to login without having a user account first. Define the allowed providers
|
|
# using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
|
|
# User accounts will be created automatically when authentication was successful.
|
|
allow_single_sign_on: ["{{OAUTH_ALLOW_SSO}}"]
|
|
|
|
# Locks down those users until they have been cleared by the admin (default: true).
|
|
block_auto_created_users: {{OAUTH_BLOCK_AUTO_CREATED_USERS}}
|
|
# Look up new users in LDAP servers. If a match is found (same uid), automatically
|
|
# link the omniauth identity with the LDAP account. (default: false)
|
|
auto_link_ldap_user: {{OAUTH_AUTO_LINK_LDAP_USER}}
|
|
|
|
# Allow users with existing accounts to login and auto link their account via SAML
|
|
# login, without having to do a manual login first and manually add SAML
|
|
# (default: false)
|
|
auto_link_saml_user: {{OAUTH_AUTO_LINK_SAML_USER}}
|
|
|
|
# Allow users with existing accounts to login and auto link their account via the
|
|
# defined Omniauth providers login, without having to do a manual login first and
|
|
# manually connect their chosen provider.
|
|
# (default: [])
|
|
auto_link_user: [{{OAUTH_AUTO_LINK_USER}}]
|
|
|
|
# Set different Omniauth providers as external so that all users creating accounts
|
|
# via these providers will not be able to have access to internal projects. You
|
|
# will need to use the full name of the provider, like `google_oauth2` for Google.
|
|
# Refer to the examples below for the full names of the supported providers.
|
|
# (default: [])
|
|
external_providers: [{{OAUTH_EXTERNAL_PROVIDERS}}]
|
|
|
|
# CAUTION!
|
|
# This allows users to login with the specified providers without two factor. Define the allowed providers
|
|
# using an array, e.g. ["twitter", 'google_oauth2'], or as true/false to allow all providers or none.
|
|
# This option should only be configured for providers which already have two factor.
|
|
# This configration dose not apply to SAML.
|
|
# (default: false)
|
|
allow_bypass_two_factor: {{OAUTH_ALLOW_BYPASS_TWO_FACTOR}}
|
|
|
|
## Auth providers
|
|
# Uncomment the following lines and fill in the data of the auth provider you want to use
|
|
# If your favorite auth provider is not listed you can use others:
|
|
# see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations
|
|
# The 'app_id' and 'app_secret' parameters are always passed as the first two
|
|
# arguments, followed by optional 'args' which can be either a hash or an array.
|
|
# Documentation for this is available at http://doc.gitlab.com/ce/integration/omniauth.html
|
|
providers:
|
|
# See omniauth-cas3 for more configuration details
|
|
- { name: 'cas3',
|
|
label: '{{OAUTH_CAS3_LABEL}}',
|
|
args: {
|
|
url: '{{OAUTH_CAS3_SERVER}}',
|
|
disable_ssl_verification: {{OAUTH_CAS3_DISABLE_SSL_VERIFICATION}},
|
|
login_url: '{{OAUTH_CAS3_LOGIN_URL}}',
|
|
service_validate_url: '{{OAUTH_CAS3_VALIDATE_URL}}',
|
|
logout_url: '{{OAUTH_CAS3_LOGOUT_URL}}'} }
|
|
- { name: 'authentiq',
|
|
app_id: '{{OAUTH_AUTHENTIQ_CLIENT_ID}}',
|
|
app_secret: 'OAUTH_AUTHENTIQ_CLIENT_SECRET',
|
|
args: { scope: {{OAUTH_AUTHENTIQ_SCOPE}}, redirect_uri: '{{OAUTH_AUTHENTIQ_REDIRECT_URI}}' } }
|
|
- { name: 'github',
|
|
label: 'GitHub',
|
|
app_id: '{{OAUTH_GITHUB_API_KEY}}',
|
|
app_secret: '{{OAUTH_GITHUB_APP_SECRET}}',
|
|
url: "{{OAUTH_GITHUB_URL}}",
|
|
verify_ssl: {{OAUTH_GITHUB_VERIFY_SSL}},
|
|
args: { scope: '{{OAUTH_GITHUB_SCOPE}}' } }
|
|
- { name: 'bitbucket',
|
|
app_id: '{{OAUTH_BITBUCKET_API_KEY}}',
|
|
app_secret: '{{OAUTH_BITBUCKET_APP_SECRET}}',
|
|
url: '{{OAUTH_BITBUCKET_URL}}' }
|
|
- { name: 'gitlab',
|
|
label: 'GitLab.com',
|
|
app_id: '{{OAUTH_GITLAB_API_KEY}}',
|
|
app_secret: '{{OAUTH_GITLAB_APP_SECRET}}',
|
|
args: { scope: '{{OAUTH_GITLAB_SCOPE}}' } }
|
|
- { name: 'google_oauth2',
|
|
label: 'Google',
|
|
app_id: '{{OAUTH_GOOGLE_API_KEY}}',
|
|
app_secret: '{{OAUTH_GOOGLE_APP_SECRET}}',
|
|
args: {
|
|
access_type: 'offline',
|
|
approval_prompt: '{{OAUTH_GOOGLE_APPROVAL_PROMPT}}',
|
|
hd: [{{OAUTH_GOOGLE_RESTRICT_DOMAIN}}] } }
|
|
- { name: 'facebook',
|
|
app_id: '{{OAUTH_FACEBOOK_API_KEY}}',
|
|
app_secret: '{{OAUTH_FACEBOOK_APP_SECRET}}' }
|
|
- { name: 'twitter',
|
|
app_id: '{{OAUTH_TWITTER_API_KEY}}',
|
|
app_secret: '{{OAUTH_TWITTER_APP_SECRET}}' }
|
|
- { name: 'saml',
|
|
label: '{{OAUTH_SAML_LABEL}}',
|
|
groups_attribute: '{{OAUTH_SAML_GROUPS_ATTRIBUTE}}',
|
|
external_groups: [{{OAUTH_SAML_EXTERNAL_GROUPS}}],
|
|
args: {
|
|
assertion_consumer_service_url: '{{OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL}}',
|
|
idp_cert_fingerprint: '{{OAUTH_SAML_IDP_CERT_FINGERPRINT}}',
|
|
idp_sso_target_url: '{{OAUTH_SAML_IDP_SSO_TARGET_URL}}',
|
|
issuer: '{{OAUTH_SAML_ISSUER}}',
|
|
attribute_statements: {
|
|
first_name: ['{{OAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME}}'],
|
|
last_name: ['{{OAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME}}'],
|
|
username: ['{{OAUTH_SAML_ATTRIBUTE_STATEMENTS_USERNAME}}'],
|
|
name: ['{{OAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME}}'],
|
|
email: ['{{OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL}}'] },
|
|
name_identifier_format: '{{OAUTH_SAML_NAME_IDENTIFIER_FORMAT}}' } }
|
|
- { name: 'crowd',
|
|
args: {
|
|
crowd_server_url: '{{OAUTH_CROWD_SERVER_URL}}',
|
|
application_name: '{{OAUTH_CROWD_APP_NAME}}',
|
|
application_password: '{{OAUTH_CROWD_APP_PASSWORD}}' } }
|
|
- { name: 'auth0',
|
|
args: {
|
|
client_id: '{{OAUTH_AUTH0_CLIENT_ID}}',
|
|
client_secret: '{{OAUTH_AUTH0_CLIENT_SECRET}}',
|
|
domain: '{{OAUTH_AUTH0_DOMAIN}}',
|
|
scope: '{{OAUTH_AUTH0_SCOPE}}' } }
|
|
- { name: 'oauth2_generic',
|
|
app_id: '{{OAUTH2_GENERIC_APP_ID}}',
|
|
app_secret: '{{OAUTH2_GENERIC_APP_SECRET}}',
|
|
args: {
|
|
client_options: {
|
|
site: '{{OAUTH2_GENERIC_CLIENT_SITE}}',
|
|
user_info_url: '{{OAUTH2_GENERIC_CLIENT_USER_INFO_URL}}',
|
|
authorize_url: '{{OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL}}',
|
|
token_url: '{{OAUTH2_GENERIC_CLIENT_TOKEN_URL}}',
|
|
end_session_endpoint: '{{OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT}}',
|
|
},
|
|
user_response_structure: {
|
|
id_path: '{{OAUTH2_GENERIC_ID_PATH}}',
|
|
attributes: {
|
|
uid: '{{OAUTH2_GENERIC_USER_UID}}',
|
|
name: '{{OAUTH2_GENERIC_USER_NAME}}',
|
|
email: '{{OAUTH2_GENERIC_USER_EMAIL}}'
|
|
}
|
|
},
|
|
authorize_params: { scope: "{{OAUTH2_GENERIC_AUTHORIZE_PARAMS_SCOPE}}" },
|
|
label: '{{OAUTH2_GENERIC_LABEL}}',
|
|
name: '{{OAUTH2_GENERIC_NAME}}' }}
|
|
- { name: 'azure_oauth2',
|
|
args: {
|
|
client_id: '{{OAUTH_AZURE_API_KEY}}',
|
|
client_secret: '{{OAUTH_AZURE_API_SECRET}}',
|
|
tenant_id: '{{OAUTH_AZURE_TENANT_ID}}' } }
|
|
- { name: 'azure_activedirectory_v2',
|
|
label: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_LABEL}}',
|
|
args: {
|
|
client_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_ID}}',
|
|
client_secret: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_SECRET}}',
|
|
tenant_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_TENANT_ID}}' } }
|
|
- { name: 'openid_connect',
|
|
label: '{{OAUTH_OIDC_LABEL}}',
|
|
icon: '{{OAUTH_OIDC_ICON}}',
|
|
args: {
|
|
name: 'openid_connect',
|
|
scope: {{OAUTH_OIDC_SCOPE}},
|
|
response_type: '{{OAUTH_OIDC_RESPONSE_TYPE}}',
|
|
issuer: '{{OAUTH_OIDC_ISSUER}}',
|
|
discovery: {{OAUTH_OIDC_DISCOVERY}},
|
|
client_auth_method: '{{OAUTH_OIDC_CLIENT_AUTH_METHOD}}',
|
|
uid_field: '{{OAUTH_OIDC_UID_FIELD}}',
|
|
send_scope_to_token_endpoint: {{OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP}},
|
|
pkce: {{OAUTH_OIDC_PKCE}},
|
|
client_options: {
|
|
identifier: '{{OAUTH_OIDC_CLIENT_ID}}',
|
|
secret: '{{OAUTH_OIDC_CLIENT_SECRET}}',
|
|
redirect_uri: '{{OAUTH_OIDC_REDIRECT_URI}}' } } }
|
|
- { name: 'jwt',
|
|
label: '{{OAUTH_JWT_LABEL}}',
|
|
args: {
|
|
secret: '{{OAUTH_JWT_SECRET}}',
|
|
algorithm: '{{OAUTH_JWT_ALGORITHM}}',
|
|
uid_claim: '{{OAUTH_JWT_UID_CLAIM}}',
|
|
required_claims: {{OAUTH_JWT_REQUIRED_CLAIMS}},
|
|
info_map: { name: '{{OAUTH_JWT_INFO_MAP_NAME}}', email: '{{OAUTH_JWT_INFO_MAP_EMAIL}}' },
|
|
auth_url: '{{OAUTH_JWT_AUTH_URL}}',
|
|
valid_within: {{OAUTH_JWT_VALID_WITHIN}} } }
|
|
# SSO maximum session duration in seconds. Defaults to CAS default of 8 hours.
|
|
# cas3:
|
|
# session_duration: 28800
|
|
|
|
# Shared file storage settings
|
|
shared:
|
|
path: {{GITLAB_SHARED_DIR}} # Default: shared
|
|
|
|
# Gitaly settings
|
|
gitaly:
|
|
# Path to the directory containing Gitaly client executables.
|
|
client_path: {{GITALY_CLIENT_PATH}}
|
|
# Default Gitaly authentication token. Can be overridden per storage. Can
|
|
# be left blank when Gitaly is running locally on a Unix socket, which
|
|
# is the normal way to deploy Gitaly.
|
|
token: {{GITALY_TOKEN}}
|
|
|
|
#
|
|
# 4. Advanced settings
|
|
# ==========================
|
|
|
|
## Repositories settings
|
|
repositories:
|
|
# Paths where repositories can be stored. Give the canonicalized absolute pathname.
|
|
# IMPORTANT: None of the path components may be symlink, because
|
|
# gitlab-shell invokes Dir.pwd inside the repository path and that results
|
|
# real path not the symlink.
|
|
storages: # You must have at least a `default` storage path.
|
|
default:
|
|
path: {{GITLAB_REPOS_DIR}}/
|
|
gitaly_address: unix:{{GITLAB_INSTALL_DIR}}/tmp/sockets/private/gitaly.socket # TCP connections are supported too (e.g. tcp://host:port). TLS connections are also supported using the system certificate pool (eg: tls://host:port).
|
|
# gitaly_token: 'special token' # Optional: override global gitaly.token for this storage.
|
|
|
|
## Backup settings
|
|
backup:
|
|
path: "{{GITLAB_BACKUP_DIR}}" # Relative paths are relative to Rails.root (default: tmp/backups/)
|
|
archive_permissions: {{GITLAB_BACKUP_ARCHIVE_PERMISSIONS}} # Permissions for the resulting backup.tar file (default: 0600)
|
|
keep_time: {{GITLAB_BACKUP_EXPIRY}} # default: 0 (forever) (in seconds)
|
|
pg_schema: {{GITLAB_BACKUP_PG_SCHEMA}} # default: nil, it means that all schemas will be backed up
|
|
upload:
|
|
# Fog storage connection settings, see http://fog.io/storage/ .
|
|
#start-aws
|
|
connection:
|
|
provider: AWS
|
|
region: {{AWS_BACKUP_REGION}}
|
|
endpoint: {{AWS_BACKUP_ENDPOINT}}
|
|
path_style: {{AWS_BACKUP_PATH_STYLE}}
|
|
aws_access_key_id: {{AWS_BACKUP_ACCESS_KEY_ID}}
|
|
aws_secret_access_key: '{{AWS_BACKUP_SECRET_ACCESS_KEY}}'
|
|
aws_signature_version: {{AWS_BACKUP_SIGNATURE_VERSION}}
|
|
# The remote 'directory' to store your backups. For S3, this would be the bucket name.
|
|
remote_directory: '{{AWS_BACKUP_BUCKET}}'
|
|
#start-multipart-aws
|
|
# Use multipart uploads when file size reaches 100MB, see
|
|
# http://docs.aws.amazon.com/AmazonS3/latest/dev/uploadobjusingmpu.html
|
|
multipart_chunk_size: {{AWS_BACKUP_MULTIPART_CHUNK_SIZE}}
|
|
#end-multipart-aws
|
|
#start-encryption-aws
|
|
# Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
|
|
encryption: 'AES256'
|
|
# Turns on AWS Server-Side Encryption with Amazon Customer-Provided Encryption Keys for backups, this is optional
|
|
# This should be set to the 256-bit encryption key for Amazon S3 to use to encrypt or decrypt your data.
|
|
# 'encryption' must also be set in order for this to have any effect.
|
|
# encryption_key: '<key>'
|
|
#end-encryption-aws
|
|
# Specifies Amazon S3 storage class to use for backups, this is optional
|
|
storage_class: '{{AWS_BACKUP_STORAGE_CLASS}}'
|
|
#end-aws
|
|
#start-gcs
|
|
# Fog storage connection settings, see http://fog.io/storage/ .
|
|
connection:
|
|
provider: Google
|
|
google_storage_access_key_id: {{GCS_BACKUP_ACCESS_KEY_ID}}
|
|
google_storage_secret_access_key: '{{GCS_BACKUP_SECRET_ACCESS_KEY}}'
|
|
remote_directory: '{{GCS_BACKUP_BUCKET}}'
|
|
#end-gcs
|
|
|
|
## Pseudonymizer exporter
|
|
pseudonymizer:
|
|
# Tables manifest that specifies the fields to extract and pseudonymize.
|
|
manifest: config/pseudonymizer.yml
|
|
upload:
|
|
remote_directory: 'gitlab-elt'
|
|
# Fog storage connection settings, see http://fog.io/storage/ .
|
|
connection:
|
|
# provider: AWS
|
|
# region: eu-west-1
|
|
# aws_access_key_id: AKIAKIAKI
|
|
# aws_secret_access_key: 'secret123'
|
|
# # The remote 'directory' to store the CSV files. For S3, this would be the bucket name.
|
|
|
|
## GitLab Shell settings
|
|
gitlab_shell:
|
|
path: {{GITLAB_SHELL_INSTALL_DIR}}/
|
|
authorized_keys_file: {{GITLAB_HOME}}/.ssh/authorized_keys
|
|
|
|
# File that contains the secret key for verifying access for gitlab-shell.
|
|
# Default is '.gitlab_shell_secret' relative to Rails.root (i.e. root of the GitLab app).
|
|
secret_file: {{GITLAB_INSTALL_DIR}}/.gitlab_shell_secret
|
|
|
|
# Git over HTTP
|
|
upload_pack: true
|
|
receive_pack: true
|
|
|
|
# Git import/fetch timeout, in seconds. Defaults to 3 hours.
|
|
# git_timeout: 10800
|
|
|
|
# If you use non-standard ssh port you need to specify it
|
|
ssh_port: {{GITLAB_SSH_PORT}}
|
|
|
|
workhorse:
|
|
# File that contains the secret key for verifying access for gitlab-workhorse.
|
|
# Default is '.gitlab_workhorse_secret' relative to Rails.root (i.e. root of the GitLab app).
|
|
# secret_file: /home/git/gitlab/.gitlab_workhorse_secret
|
|
|
|
## GitLab Elasticsearch settings
|
|
elasticsearch:
|
|
indexer_path: {{GITLAB_HOME}}/gitlab-elasticsearch-indexer/
|
|
|
|
## Git settings
|
|
# CAUTION!
|
|
# Use the default values unless you really know what you are doing
|
|
git:
|
|
bin_path: /usr/local/bin/git
|
|
|
|
## ActionCable settings
|
|
action_cable:
|
|
# Number of threads used to process ActionCable connection callbacks and channel actions
|
|
# worker_pool_size: 4
|
|
|
|
## Webpack settings
|
|
# If enabled, this will tell rails to serve frontend assets from the webpack-dev-server running
|
|
# on a given port instead of serving directly from /assets/webpack. This is only indended for use
|
|
# in development.
|
|
webpack:
|
|
# dev_server:
|
|
# enabled: true
|
|
# host: localhost
|
|
# port: 3808
|
|
|
|
## Monitoring
|
|
# Built in monitoring settings
|
|
monitoring:
|
|
# Time between sampling of unicorn socket metrics, in seconds
|
|
unicorn_sampler_interval: {{GITLAB_MONITORING_UNICORN_SAMPLER_INTERVAL}}
|
|
# Time between sampling of Puma metrics, in seconds
|
|
# puma_sampler_interval: 5
|
|
# IP whitelist to access monitoring endpoints
|
|
ip_whitelist:
|
|
- 127.0.0.0/8
|
|
- {{GITLAB_MONITORING_IP_WHITELIST}}
|
|
|
|
# Sidekiq exporter is webserver built in to Sidekiq to expose Prometheus metrics
|
|
sidekiq_exporter:
|
|
enabled: {{GITLAB_MONITORING_SIDEKIQ_EXPORTER_ENABLED}}
|
|
address: {{GITLAB_MONITORING_SIDEKIQ_EXPORTER_ADDRESS}}
|
|
port: {{GITLAB_MONITORING_SIDEKIQ_EXPORTER_PORT}}
|
|
|
|
# Web exporter is webserver built in to Unicorn/Puma to expose Prometheus metrics
|
|
# It runs alongside the `/metrics` endpoints to ease the publish of metrics
|
|
web_exporter:
|
|
# enabled: true
|
|
# address: localhost
|
|
# port: 8083
|
|
|
|
## Prometheus settings
|
|
# Do not modify these settings here. They should be modified in /etc/gitlab/gitlab.rb
|
|
# if you installed GitLab via Omnibus.
|
|
# If you installed from source, you need to install and configure Prometheus
|
|
# yourself, and then update the values here.
|
|
# https://docs.gitlab.com/ee/administration/monitoring/prometheus/
|
|
prometheus:
|
|
# enable: true
|
|
# listen_address: 'localhost:9090'
|
|
|
|
shutdown:
|
|
# # blackout_seconds:
|
|
# # defines an interval to block healthcheck,
|
|
# # but continue accepting application requests
|
|
# # this allows Load Balancer to notice service
|
|
# # being shutdown and not interrupt any of the clients
|
|
# blackout_seconds: 10
|
|
|
|
#
|
|
# 5. Extra customization
|
|
# ==========================
|
|
|
|
extra:
|
|
## Google analytics. Uncomment if you want it
|
|
google_analytics_id: '{{GOOGLE_ANALYTICS_ID}}'
|
|
|
|
## Piwik analytics.
|
|
piwik_url: '{{PIWIK_URL}}'
|
|
piwik_site_id: '{{PIWIK_SITE_ID}}'
|
|
|
|
rack_attack:
|
|
git_basic_auth:
|
|
# Rack Attack IP banning enabled
|
|
enabled: {{RACK_ATTACK_ENABLED}}
|
|
#
|
|
# Whitelist requests from 127.0.0.1 for web proxies (NGINX/Apache) with incorrect headers
|
|
ip_whitelist: {{RACK_ATTACK_WHITELIST}}
|
|
#
|
|
# Limit the number of Git HTTP authentication attempts per IP
|
|
maxretry: {{RACK_ATTACK_MAXRETRY}}
|
|
#
|
|
# Reset the auth attempt counter per IP after 60 seconds
|
|
findtime: {{RACK_ATTACK_FINDTIME}}
|
|
#
|
|
# Ban an IP for one hour (3600s) after too many auth attempts
|
|
bantime: {{RACK_ATTACK_BANTIME}}
|
|
|
|
development:
|
|
<<: *base
|
|
|
|
# We want to run web/sidekiq exporters for devs
|
|
# to catch errors from using them.
|
|
#
|
|
# We use random port to not block ability to run
|
|
# multiple instances of the service
|
|
monitoring:
|
|
sidekiq_exporter:
|
|
enabled: true
|
|
address: 127.0.0.1
|
|
port: 0
|
|
web_exporter:
|
|
enabled: true
|
|
address: 127.0.0.1
|
|
port: 0
|
|
|
|
test:
|
|
<<: *base
|
|
gravatar:
|
|
enabled: true
|
|
external_diffs:
|
|
enabled: false
|
|
# Diffs may be `always` external (the default), or they can be made external
|
|
# after they have become `outdated` (i.e., the MR is closed or a new version
|
|
# has been pushed).
|
|
# when: always
|
|
# The location where external diffs are stored (default: shared/external-diffs).
|
|
# storage_path: shared/external-diffs
|
|
object_store:
|
|
enabled: false
|
|
remote_directory: external-diffs # The bucket name
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
lfs:
|
|
enabled: false
|
|
# The location where LFS objects are stored (default: shared/lfs-objects).
|
|
# storage_path: shared/lfs-objects
|
|
object_store:
|
|
enabled: false
|
|
remote_directory: lfs-objects # The bucket name
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
artifacts:
|
|
path: tmp/tests/artifacts
|
|
enabled: true
|
|
# The location where build artifacts are stored (default: shared/artifacts).
|
|
# path: shared/artifacts
|
|
object_store:
|
|
enabled: false
|
|
remote_directory: artifacts # The bucket name
|
|
background_upload: false
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
uploads:
|
|
storage_path: tmp/tests/public
|
|
object_store:
|
|
enabled: false
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
|
|
terraform_state:
|
|
enabled: true
|
|
storage_path: tmp/tests/terraform_state
|
|
object_store:
|
|
enabled: false
|
|
remote_directory: terraform_state
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
|
|
gitlab:
|
|
host: localhost
|
|
port: 80
|
|
|
|
content_security_policy:
|
|
enabled: true
|
|
report_only: false
|
|
directives:
|
|
base_uri:
|
|
child_src:
|
|
connect_src:
|
|
default_src: "'self'"
|
|
font_src:
|
|
form_action:
|
|
frame_ancestors: "'self'"
|
|
frame_src: "'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"
|
|
img_src: "* data: blob:"
|
|
manifest_src:
|
|
media_src:
|
|
object_src: "'none'"
|
|
script_src: "'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
|
|
style_src: "'self' 'unsafe-inline'"
|
|
worker_src: "'self' blob:"
|
|
report_uri:
|
|
|
|
# When you run tests we clone and set up gitlab-shell
|
|
# In order to set it up correctly you need to specify
|
|
# your system username you use to run GitLab
|
|
# user: YOUR_USERNAME
|
|
pages:
|
|
path: tmp/tests/pages
|
|
repositories:
|
|
storages:
|
|
default:
|
|
path: tmp/tests/repositories/
|
|
gitaly_address: unix:tmp/tests/gitaly/gitaly.socket
|
|
|
|
gitaly:
|
|
client_path: tmp/tests/gitaly
|
|
token: secret
|
|
workhorse:
|
|
secret_file: tmp/gitlab_workhorse_test_secret
|
|
backup:
|
|
path: tmp/tests/backups
|
|
pseudonymizer:
|
|
manifest: config/pseudonymizer.yml
|
|
upload:
|
|
# The remote 'directory' to store the CSV files. For S3, this would be the bucket name.
|
|
remote_directory: gitlab-elt.test
|
|
# Fog storage connection settings, see http://fog.io/storage/
|
|
connection:
|
|
provider: AWS # Only AWS supported at the moment
|
|
aws_access_key_id: AWS_ACCESS_KEY_ID
|
|
aws_secret_access_key: AWS_SECRET_ACCESS_KEY
|
|
region: us-east-1
|
|
gitlab_shell:
|
|
path: tmp/tests/gitlab-shell/
|
|
authorized_keys_file: tmp/tests/authorized_keys
|
|
issues_tracker:
|
|
redmine:
|
|
title: "Redmine"
|
|
project_url: "http://redmine/projects/:issues_tracker_id"
|
|
issues_url: "http://redmine/:project_id/:issues_tracker_id/:id"
|
|
new_issue_url: "http://redmine/projects/:issues_tracker_id/issues/new"
|
|
jira:
|
|
title: "Jira"
|
|
url: https://sample_company.atlassian.net
|
|
project_key: PROJECT
|
|
|
|
omniauth:
|
|
# enabled: true
|
|
allow_single_sign_on: true
|
|
external_providers: []
|
|
|
|
providers:
|
|
- { name: 'cas3',
|
|
label: 'cas3',
|
|
args: { url: 'https://sso.example.com',
|
|
disable_ssl_verification: false,
|
|
login_url: '/cas/login',
|
|
service_validate_url: '/cas/p3/serviceValidate',
|
|
logout_url: '/cas/logout'} }
|
|
- { name: 'github',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET',
|
|
url: "https://github.com/",
|
|
verify_ssl: false,
|
|
args: { scope: 'user:email' } }
|
|
- { name: 'bitbucket',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET' }
|
|
- { name: 'gitlab',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET',
|
|
args: { scope: 'api' } }
|
|
- { name: 'google_oauth2',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET',
|
|
args: { access_type: 'offline', approval_prompt: '' } }
|
|
- { name: 'facebook',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET' }
|
|
- { name: 'twitter',
|
|
app_id: 'YOUR_APP_ID',
|
|
app_secret: 'YOUR_APP_SECRET' }
|
|
- { name: 'jwt',
|
|
app_secret: 'YOUR_APP_SECRET',
|
|
args: {
|
|
algorithm: 'HS256',
|
|
uid_claim: 'email',
|
|
required_claims: ["name", "email"],
|
|
info_map: { name: "name", email: "email" },
|
|
auth_url: 'https://example.com/',
|
|
valid_within: null,
|
|
}
|
|
}
|
|
- { name: 'auth0',
|
|
args: {
|
|
client_id: 'YOUR_AUTH0_CLIENT_ID',
|
|
client_secret: 'YOUR_AUTH0_CLIENT_SECRET',
|
|
namespace: 'YOUR_AUTH0_DOMAIN' } }
|
|
- { name: 'authentiq',
|
|
app_id: 'YOUR_CLIENT_ID',
|
|
app_secret: 'YOUR_CLIENT_SECRET',
|
|
args: { scope: 'aq:name email~rs address aq:push' } }
|
|
- { name: 'salesforce',
|
|
app_id: 'YOUR_CLIENT_ID',
|
|
app_secret: 'YOUR_CLIENT_SECRET'
|
|
}
|
|
ldap:
|
|
enabled: false
|
|
servers:
|
|
main:
|
|
label: ldap
|
|
host: 127.0.0.1
|
|
port: 3890
|
|
uid: 'uid'
|
|
encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
|
|
base: 'dc=example,dc=com'
|
|
user_filter: ''
|
|
group_base: 'ou=groups,dc=example,dc=com'
|
|
admin_group: ''
|
|
prometheus:
|
|
enable: true
|
|
listen_address: 'localhost:9090'
|
|
|
|
staging:
|
|
<<: *base
|