Commit Graph

220 Commits

Author SHA1 Message Date
Yaya
1a22627603 nixos/gitlab: Add a warning message
GitLab instances created or updated between versions [15.11.0, 15.11.2]
have an incorrect database schema. [1] This will become a problem once
upgrading GitLab to >=16.2.0.

A workaround can be found in the GitLab docs: [2]

[1]: https://gitlab.com/gitlab-org/gitlab/-/issues/408835
[2]: https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later
2023-09-05 13:46:44 +02:00
ajs124
97dfc365e6 gitlab: 16.1.4 -> 16.3.1
https://gitlab.com/gitlab-org/gitlab/-/blob/v16.3.1-ee/CHANGELOG.md

Fixes CVE-2022-4343
Fixes CVE-2023-0120
Fixes CVE-2023-1279
Fixes CVE-2023-1555
Fixes CVE-2023-3205
Fixes CVE-2023-3915
Fixes CVE-2023-3950
Fixes CVE-2023-4018
Fixes CVE-2023-4378
Fixes CVE-2023-4630
Fixes CVE-2023-4638
Fixes CVE-2023-4647

Co-Authored-By: Yaya <github@uwu.is>
2023-09-05 13:46:44 +02:00
Oliver Schmidt
ff9296f93e
nixos/gitlab: ensure service started again after dependency restarts (#245240)
When a dependency, like postgresql.service or redis-gitlab.service, had
been stopped and started at switch-to-configuration time, gitlab.service
and its helper units had been stopped but not started again.
`multi-user.target` only has a `Wants` relation to gitlab.target, but
once gitlab.target has been successfully started once and is not stopped/
restarted again, it does not cause all its dependencies to stay activated
the whole time.

This commit fixes this by upgrading the dependy relationship of
gitlab.service towards gitlab.target from a "Wants" to a "Requires". It
should be enough to do this for this single unit part of gitlab.target
only, as all other units wantedBy gitlab.target are pulled in by
gitlab.service as well or have bindsTo relations.
2023-07-30 18:49:54 +02:00
Pol Dellaiera
764472b473
Merge pull request #233091 from yayayayaka/add-team-gitlab
maintainers/team-list: Add team gitlab
2023-07-07 15:19:15 +02:00
Alexander Sieg
8d80108d6d nixos/gitlab: configure elasticsearch indexer path 2023-07-05 15:01:31 +02:00
Alexander Sieg
8934558abf
nixos/gitlab: fix unit test result display (#241322)
After the update to GitLab 16 the puma worker needs `gzip` in it's PATH
in order to junit test results.
2023-07-04 18:57:19 +02:00
Yaya
7d432c1ff9 nixos/gitlab: Add an additional folder to systemd-tmpfiles 2023-06-27 11:39:17 +02:00
Tom Siewert
50d66bcba6
nixos/gitlab: Fix config reference for registry (#235639)
Support for gitlab-container-registry has been added in 014816cbe4.
However, when enabling the registry it will throw an error as it can't
find a `package` attribute.

This commit fixes the registry configuration by adding the missing
`registry` part.
2023-06-04 02:32:35 +02:00
Yaya
e9594e6031 nixos/gitlab: Warn users who are still using an external registry
This adds a warning for GitLab >=16.0.0 users who are still using an
external container registry such as `pkgs.docker-distribution`. Support
for external container registries has ended in GitLab 16.0 [1] and is
scheduled for removal in a future release. [2]

[1]: https://gitlab.com/gitlab-org/gitlab/-/issues/376217
[2]: https://gitlab.com/gitlab-org/gitlab/-/issues/403322
2023-05-31 22:14:25 +02:00
Yaya
014816cbe4 nixos/gitlab: Add support for gitlab-container-registry
Support for external container registries (namely
`pkgs.docker-distribution`) has ended in GitLab 16.0 [1] and is
scheduled for removal in a future release. [2]

This commit adds a new registry package option, defaulting to
`pkgs.docker-distribution` and `pkgs.gitlab-container-registry` for
system state versions >= 23.11.

While it is still possible to use the docker container registry, module
users should switch to gitlab's container registry fork soon. A warning
message will be added in a future commit to advise affected users to
back up their state and then switch to the new container registry
package.

[1]: https://gitlab.com/gitlab-org/gitlab/-/issues/376217
[2]: https://gitlab.com/gitlab-org/gitlab/-/issues/403322
2023-05-31 22:14:25 +02:00
Yaya
2a4536952a nixos/gitlab: Require at least postgresql 13.6
https://docs.gitlab.com/16.0/ee/install/requirements.html#postgresql-requirements
2023-05-31 22:14:25 +02:00
Yaya
4321e48b68 nixos/gitlab: Remove procps from gitaly service
From my understanding, procps was added to the gitlay systemd service
path in #58487 to fix gitaly-ruby's internal memory leak detection.

Now that the last ruby remnants have been removed in gitaly 16.0.0,
this should not be necessary anymore.
2023-05-31 22:14:25 +02:00
Yaya
33411f2768 nixos/gitlab: Update redis configuration
Configuring Redis via environment variable is not supported anymore
since [1].

[1] 1242965361
2023-05-31 22:14:25 +02:00
Yaya
6fed71cab2 gitaly: Remove ruby dependencies
Ruby dependencies in gitaly have been removed in the 16.0.0 release. [1]

See GitLab Epic &2862 [2] for more info.

[1]: 689556e70a
[2]: https://gitlab.com/groups/gitlab-org/-/epics/2862
2023-05-31 22:14:25 +02:00
Yaya
27d73b3d46 nixos/gitlab: Add gitlab team members to maintainers 2023-05-20 20:38:49 +00:00
Felix Buehler
327b0cff7a treewide: use more lib.optionalString 2023-04-07 13:38:33 +02:00
talyz
ccaa6078ba
nixos/gitlab: Fix error when GitLab Pages is not enabled
Even if GitLab is used without Pages, some of its settings are still
used in the gitlab.yml file, resulting in errors such as

error: The option `services.gitlab.pages.settings.pages-domain' is used but not defined.

To fix this, make the settings' usage conditional on Pages being
enabled.
2023-03-18 11:34:51 +01:00
Yureka
7efee351ec
Merge branch 'gitlab-pages' of github.com:talyz/nixpkgs into HEAD 2023-03-10 14:36:25 +01:00
pennae
0a6e6cf7e6 nixos/manual: render module chapters with nixos-render-docs
this converts meta.doc into an md pointer, not an xml pointer. since we
no longer need xml for manual chapters we can also remove support for
manual chapters from md-to-db.sh

since pandoc converts smart quotes to docbook quote elements and our
nixos-render-docs does not we lose this distinction in the rendered
output. that's probably not that bad, our stylesheet didn't make use of
this anyway (and pre-23.05 versions of the chapters didn't use quote
elements either).

also updates the nixpkgs manual to clarify that option docs support all
extensions (although it doesn't support headings at all, so heading
anchors don't work by extension).
2023-01-27 20:07:34 +01:00
talyz
2d4f4e9bdf
nixos/gitlab: Handle secrets in GitLab Pages config 2023-01-17 17:34:47 +01:00
talyz
dbd563b9b8
nixos/gitlab: Improve support for GitLab Pages
- provide options and set defaults for important settings
- generate the shared secret
- reenable gitlab-pages in test
2023-01-17 17:33:47 +01:00
Franz Pletz
b88913fb11
nixos/gitlab: set gitaly runtime dir
If `runtime_dir` is not set, gitaly will use `/tmp` as a place for sockets
and packed binaries like `git2go`. If the gitlab instance does not experience
much traffic and gitlay is not restarted regularly, systemd-tmpfiles will
remove the binaries. This breaks some gitlab functionality until gitaly is
restarted manually.
2023-01-13 11:26:52 +01:00
Daniel Nagy
ad866e565d
treewide: switch to port type for nixos modules 2022-12-08 00:00:00 +01:00
M. A
6b3629a3a2 Revert "nixos/gitlab: Use Git 2.35.x to work around git bug"
This reverts commit f94d14899d70150abcf2823e243524397b0c1806.

git 2.35.x became unsupported by gitaly and makes the gitaly systemd
service fail.
2022-11-23 15:18:19 +00:00
Dominique Martinet
01ff1dd23f logrotate service: cleanup deprecated options 2022-11-05 10:34:03 +09:00
github-actions[bot]
8972888c55
Merge master into staging-next 2022-10-09 12:01:31 +00:00
talyz
fae653deb4 nixos/gitlab: Configure ActionCable
ActionCable is used to provide realtime updates in a few places,
mainly the issue sidebar.
2022-10-09 08:12:19 +02:00
talyz
9b3ff51c77 nixos/gitlab: Set a more appropriate type for extraConfig 2022-10-09 08:12:19 +02:00
talyz
58158100f7 nixos/gitlab: Make sure docker-registry starts after cert generation 2022-10-09 08:12:19 +02:00
talyz
8e8253ddb4 nixos/gitlab: Create registry state path 2022-10-09 08:12:19 +02:00
talyz
3dedfb3fa0 nixos/gitlab: Connect to redis through a unix socket by default
This gives us slightly higher security as you have to be in the gitlab
group to connect, and possibly a (very small) performance benefit as
well.
2022-10-09 08:12:19 +02:00
talyz
843082eb3a nixos/gitlab: Add findutils to runtime dependencies
Needed for the gitlab:cleanup:orphan_job_artifact_files rake task.
2022-10-09 08:12:19 +02:00
talyz
bee6e1dafa nixos/gitlab: Deduplicate runtime dependency listing 2022-10-09 08:12:19 +02:00
talyz
0211edd1ff nixos/gitlab: Add workhorse.config option 2022-10-09 08:12:19 +02:00
Artturin
6910a4eea0 treewide: makeWrapper to nativeBuildInputs
this should be all of them other than the failed splices
found with nixpkgs-lint
2022-09-26 17:53:26 +03:00
Sandro
5e515466a9
Merge pull request #180149 from WilliButz/gitlab-module/fix-registry-issuer 2022-09-02 00:16:22 +02:00
pennae
722b99bc0e nixos/*: convert options with admonitions to MD
rendering changes only slightly, most changes are in spacing.
2022-08-31 16:36:16 +02:00
pennae
6039648c50 nixos/*: automatically convert option docs 2022-08-19 22:40:58 +02:00
pennae
d0ba463fcf nixos/*: replace <quote> with actual quotes 2022-08-19 22:40:58 +02:00
pennae
087472b1e5 nixos/*: automatically convert option docs 2022-08-06 20:39:12 +02:00
pennae
423545fe48 nixos/*: normalize manpage references to single-line form
now nix-doc-munge will not introduce whitespace changes when it replaces
manpage references with the MD equivalent.

no change to the manpage, changes to the HTML manual are whitespace only.
2022-08-05 18:34:50 +02:00
pennae
2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
M. A
61e3490c1c nixos/gitlab: Bump git to 2.35.4
Resolves CVE-2022-29187
2022-07-13 21:03:46 +00:00
WilliButz
e2a322b3cd
nixos/gitlab: fix registry.issuer setting
Prior to this change, the configuration value for
`services.gitlab.registry.issuer` was only referenced by the
docker-registry configuration and in the `gitlab-registry-cert` service
while the gitlab config used the hard-coded value "gitlab-issuer".
2022-07-04 19:31:16 +02:00
WilliButz
fbaae54932
Merge pull request #170947 from dpausp/gitlab-registry-cert-fix-path-condition
nixos/gitlab: fix gitlab-registry-cert path condition
2022-07-04 18:39:42 +02:00
Kim Lindberger
5710bac2b4
nixos/gitlab: Use Git 2.35.x to work around git bug (#177776)
Git 2.36.1 seemingly contains a commit-graph related bug which is
easily triggered through GitLab, so let's downgrade it to 2.35.x until
this issue is solved. See
https://gitlab.com/gitlab-org/gitlab/-/issues/360783#note_992870101.
2022-06-25 21:22:53 +02:00
Yureka
821724b184 nixos/gitlab: support 15.x 2022-05-22 13:09:36 +02:00
Tobias Stenzel
0c4f8e78b5 nixos/gitlab: fix gitlab-registry-cert path condition
`ConditionPathExists` belongs in the [Unit] section, not [Service].
The unit now properly checks if the cert file already
exists before activating so certs will not be overwritten anymore.
2022-04-29 23:57:57 +02:00
Alyssa Ross
8ba23e138d
Merge remote-tracking branch 'nixpkgs/staging-next' into staging
Conflicts:
	pkgs/development/libraries/zlib/default.nix
	pkgs/development/lua-modules/overrides.nix
2022-04-02 16:45:48 +00:00
Dominique Martinet
e92c05349c nixos/logrotate: convert to freeform
using freeform is the new standard way of using modules and should replace
extraConfig.
In particular, this will allow us to place a condition on mails
2022-04-01 07:09:26 +09:00