diff options
Diffstat (limited to 'config/initializers')
| -rw-r--r-- | config/initializers/01_secret_token.rb | 3 | ||||
| -rw-r--r-- | config/initializers/1_settings.rb | 28 | ||||
| -rw-r--r-- | config/initializers/active_record_ping.rb | 5 | ||||
| -rw-r--r-- | config/initializers/active_record_table_definition.rb | 4 | ||||
| -rw-r--r-- | config/initializers/gitlab_experiment.rb | 6 | ||||
| -rw-r--r-- | config/initializers/grape_validators.rb | 1 | ||||
| -rw-r--r-- | config/initializers/lograge.rb | 2 | ||||
| -rw-r--r-- | config/initializers/rack_attack.rb | 190 | ||||
| -rw-r--r-- | config/initializers/rack_attack_logging.rb | 2 | ||||
| -rw-r--r-- | config/initializers/sidekiq.rb | 2 | ||||
| -rw-r--r-- | config/initializers/structure_load_in_transaction.rb | 9 | ||||
| -rw-r--r-- | config/initializers/zz_metrics.rb | 6 |
12 files changed, 55 insertions, 203 deletions
diff --git a/config/initializers/01_secret_token.rb b/config/initializers/01_secret_token.rb index 5949f463457..d7e725477eb 100644 --- a/config/initializers/01_secret_token.rb +++ b/config/initializers/01_secret_token.rb @@ -34,6 +34,9 @@ def create_tokens openid_connect_signing_key: generate_new_rsa_private_key } + # encrypted_settings_key_base is optional for now + defaults[:encrypted_settings_key_base] = generate_new_secure_token if ENV['GITLAB_GENERATE_ENCRYPTED_SETTINGS_KEY_BASE'] + missing_secrets = set_missing_keys(defaults) write_secrets_yml(missing_secrets) unless missing_secrets.empty? diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 022f372a608..97c0e051f1f 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -3,9 +3,17 @@ require_relative '../object_store_settings' require_relative '../smime_signature_settings' # Default settings +Settings['shared'] ||= Settingslogic.new({}) +Settings.shared['path'] = Settings.absolute(Settings.shared['path'] || "shared") + +Settings['encrypted_settings'] ||= Settingslogic.new({}) +Settings.encrypted_settings['path'] ||= File.join(Settings.shared['path'], "encrypted_settings") +Settings.encrypted_settings['path'] = Settings.absolute(Settings.encrypted_settings['path']) + Settings['ldap'] ||= Settingslogic.new({}) Settings.ldap['enabled'] = false if Settings.ldap['enabled'].nil? Settings.ldap['prevent_ldap_sign_in'] = false if Settings.ldap['prevent_ldap_sign_in'].blank? +Settings.ldap['secret_file'] = Settings.absolute(Settings.ldap['secret_file'] || File.join(Settings.encrypted_settings['path'], "ldap.yaml.enc")) Gitlab.ee do Settings.ldap['sync_time'] = 3600 if Settings.ldap['sync_time'].nil? @@ -140,9 +148,6 @@ if Gitlab.ee? && Rails.env.test? && !saml_provider_enabled Settings.omniauth.providers << Settingslogic.new({ 'name' => 'group_saml' }) end -Settings['shared'] ||= Settingslogic.new({}) -Settings.shared['path'] = Settings.absolute(Settings.shared['path'] || "shared") - Settings['issues_tracker'] ||= {} # @@ -532,8 +537,14 @@ Settings.cron_jobs['member_invitation_reminder_emails_worker']['job_class'] = 'M Settings.cron_jobs['schedule_merge_request_cleanup_refs_worker'] ||= Settingslogic.new({}) Settings.cron_jobs['schedule_merge_request_cleanup_refs_worker']['cron'] ||= '* * * * *' Settings.cron_jobs['schedule_merge_request_cleanup_refs_worker']['job_class'] = 'ScheduleMergeRequestCleanupRefsWorker' +Settings.cron_jobs['manage_evidence_worker'] ||= Settingslogic.new({}) +Settings.cron_jobs['manage_evidence_worker']['cron'] ||= '0 * * * *' +Settings.cron_jobs['manage_evidence_worker']['job_class'] = 'Releases::ManageEvidenceWorker' Gitlab.ee do + Settings.cron_jobs['analytics_devops_adoption_create_all_snapshots_worker'] ||= Settingslogic.new({}) + Settings.cron_jobs['analytics_devops_adoption_create_all_snapshots_worker']['cron'] ||= '0 0 1 * *' + Settings.cron_jobs['analytics_devops_adoption_create_all_snapshots_worker']['job_class'] = 'Analytics::DevopsAdoption::CreateAllSnapshotsWorker' Settings.cron_jobs['active_user_count_threshold_worker'] ||= Settingslogic.new({}) Settings.cron_jobs['active_user_count_threshold_worker']['cron'] ||= '0 12 * * *' Settings.cron_jobs['active_user_count_threshold_worker']['job_class'] = 'ActiveUserCountThresholdWorker' @@ -546,6 +557,9 @@ Gitlab.ee do Settings.cron_jobs['adjourned_projects_deletion_cron_worker'] ||= Settingslogic.new({}) Settings.cron_jobs['adjourned_projects_deletion_cron_worker']['cron'] ||= '0 4 * * *' Settings.cron_jobs['adjourned_projects_deletion_cron_worker']['job_class'] = 'AdjournedProjectsDeletionCronWorker' + Settings.cron_jobs['geo_verification_cron_worker'] ||= Settingslogic.new({}) + Settings.cron_jobs['geo_verification_cron_worker']['cron'] ||= '* * * * *' + Settings.cron_jobs['geo_verification_cron_worker']['job_class'] ||= 'Geo::VerificationCronWorker' Settings.cron_jobs['geo_file_download_dispatch_worker'] ||= Settingslogic.new({}) Settings.cron_jobs['geo_file_download_dispatch_worker']['cron'] ||= '*/1 * * * *' Settings.cron_jobs['geo_file_download_dispatch_worker']['job_class'] ||= 'Geo::FileDownloadDispatchWorker' @@ -779,9 +793,17 @@ Settings.forti_authenticator['enabled'] = false if Settings.forti_authenticator[ Settings.forti_authenticator['port'] = 443 if Settings.forti_authenticator['port'].to_i == 0 # +# FortiToken Cloud +# +Settings['forti_token_cloud'] ||= Settingslogic.new({}) +Settings.forti_token_cloud['enabled'] = false if Settings.forti_token_cloud['enabled'].nil? + +# # Extra customization # Settings['extra'] ||= Settingslogic.new({}) +Settings.extra['matomo_site_id'] ||= Settings.extra['piwik_site_id'] if Settings.extra['piwik_site_id'].present? +Settings.extra['matomo_url'] ||= Settings.extra['piwik_url'] if Settings.extra['piwik_url'].present? # # Rack::Attack settings diff --git a/config/initializers/active_record_ping.rb b/config/initializers/active_record_ping.rb new file mode 100644 index 00000000000..349a7e4a496 --- /dev/null +++ b/config/initializers/active_record_ping.rb @@ -0,0 +1,5 @@ +# # frozen_string_literal: true + +if Gitlab::Utils.to_boolean(ENV['ENABLE_ACTIVERECORD_EMPTY_PING'], default: false) + ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.prepend(Gitlab::Database::PostgresqlAdapter::EmptyQueryPing) +end diff --git a/config/initializers/active_record_table_definition.rb b/config/initializers/active_record_table_definition.rb index 81a8e5906f4..9220620da41 100644 --- a/config/initializers/active_record_table_definition.rb +++ b/config/initializers/active_record_table_definition.rb @@ -16,7 +16,7 @@ module ActiveRecord options[:null] = false if options[:null].nil? [:created_at, :updated_at].each do |column_name| - column(column_name, :datetime_with_timezone, options) + column(column_name, :datetime_with_timezone, **options) end end @@ -27,7 +27,7 @@ module ActiveRecord # t.datetime_with_timezone :did_something_at # end def datetime_with_timezone(column_name, **options) - column(column_name, :datetime_with_timezone, options) + column(column_name, :datetime_with_timezone, **options) end # Disable timestamp alias to datetime diff --git a/config/initializers/gitlab_experiment.rb b/config/initializers/gitlab_experiment.rb new file mode 100644 index 00000000000..40b4c0dc4ee --- /dev/null +++ b/config/initializers/gitlab_experiment.rb @@ -0,0 +1,6 @@ +# frozen_string_literal: true + +Gitlab::Experiment.configure do |config| + config.base_class = 'ApplicationExperiment' + config.cache = ApplicationExperiment::Cache.new +end diff --git a/config/initializers/grape_validators.rb b/config/initializers/grape_validators.rb index 715949a276f..07dd70822a2 100644 --- a/config/initializers/grape_validators.rb +++ b/config/initializers/grape_validators.rb @@ -9,3 +9,4 @@ Grape::Validations.register_validator(:array_none_any, ::API::Validations::Valid Grape::Validations.register_validator(:check_assignees_count, ::API::Validations::Validators::CheckAssigneesCount) Grape::Validations.register_validator(:untrusted_regexp, ::API::Validations::Validators::UntrustedRegexp) Grape::Validations.register_validator(:email_or_email_list, ::API::Validations::Validators::EmailOrEmailList) +Grape::Validations.register_validator(:iteration_id, ::API::Validations::Validators::IntegerOrCustomValue) diff --git a/config/initializers/lograge.rb b/config/initializers/lograge.rb index 0ea0adf86bc..5b068c15aad 100644 --- a/config/initializers/lograge.rb +++ b/config/initializers/lograge.rb @@ -2,7 +2,6 @@ unless Gitlab::Runtime.sidekiq? Rails.application.reloader.to_prepare do filename = File.join(Rails.root, 'log', "#{Rails.env}_json.log") - db_counter = Gitlab::Metrics::Subscribers::ActiveRecord Rails.application.configure do config.lograge.enabled = true @@ -17,7 +16,6 @@ unless Gitlab::Runtime.sidekiq? data[:db_duration_s] = Gitlab::Utils.ms_to_round_sec(data.delete(:db)) if data[:db] data[:view_duration_s] = Gitlab::Utils.ms_to_round_sec(data.delete(:view)) if data[:view] data[:duration_s] = Gitlab::Utils.ms_to_round_sec(data.delete(:duration)) if data[:duration] - data.merge!(db_counter.db_counter_payload) # Remove empty hashes to prevent type mismatches # These are set to empty hashes in Lograge's ActionCable subscriber diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 58bf3f6013c..6cc4fe25765 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -1,191 +1,3 @@ # frozen_string_literal: true -# Specs for this file can be found on: -# * spec/lib/gitlab/throttle_spec.rb -# * spec/requests/rack_attack_global_spec.rb -module Gitlab::Throttle - def self.settings - Gitlab::CurrentSettings.current_application_settings - end - - # Returns true if we should use the Admin Area protected paths throttle - def self.protected_paths_enabled? - self.settings.throttle_protected_paths_enabled? - end - - def self.omnibus_protected_paths_present? - Rack::Attack.throttles.key?('protected paths') - end - - def self.bypass_header - env_value = ENV['GITLAB_THROTTLE_BYPASS_HEADER'] - return unless env_value.present? - - "HTTP_#{env_value.upcase.tr('-', '_')}" - end - - def self.unauthenticated_options - limit_proc = proc { |req| settings.throttle_unauthenticated_requests_per_period } - period_proc = proc { |req| settings.throttle_unauthenticated_period_in_seconds.seconds } - { limit: limit_proc, period: period_proc } - end - - def self.authenticated_api_options - limit_proc = proc { |req| settings.throttle_authenticated_api_requests_per_period } - period_proc = proc { |req| settings.throttle_authenticated_api_period_in_seconds.seconds } - { limit: limit_proc, period: period_proc } - end - - def self.authenticated_web_options - limit_proc = proc { |req| settings.throttle_authenticated_web_requests_per_period } - period_proc = proc { |req| settings.throttle_authenticated_web_period_in_seconds.seconds } - { limit: limit_proc, period: period_proc } - end - - def self.protected_paths_options - limit_proc = proc { |req| settings.throttle_protected_paths_requests_per_period } - period_proc = proc { |req| settings.throttle_protected_paths_period_in_seconds.seconds } - - { limit: limit_proc, period: period_proc } - end -end - -class Rack::Attack - # Order conditions by how expensive they are: - # 1. The most expensive is the `req.unauthenticated?` and - # `req.authenticated_user_id` as it performs an expensive - # DB/Redis query to validate the request - # 2. Slightly less expensive is the need to query DB/Redis - # to unmarshal settings (`Gitlab::Throttle.settings`) - # - # We deliberately skip `/-/health|liveness|readiness` - # from Rack Attack as they need to always be accessible - # by Load Balancer and additional measure is implemented - # (token and whitelisting) to prevent abuse. - throttle('throttle_unauthenticated', Gitlab::Throttle.unauthenticated_options) do |req| - if !req.should_be_skipped? && - Gitlab::Throttle.settings.throttle_unauthenticated_enabled && - req.unauthenticated? - req.ip - end - end - - throttle('throttle_authenticated_api', Gitlab::Throttle.authenticated_api_options) do |req| - if req.api_request? && - Gitlab::Throttle.settings.throttle_authenticated_api_enabled - req.authenticated_user_id([:api]) - end - end - - # Product analytics feature is in experimental stage. - # At this point we want to limit amount of events registered - # per application (aid stands for application id). - throttle('throttle_product_analytics_collector', limit: 100, period: 60) do |req| - if req.product_analytics_collector_request? - req.params['aid'] - end - end - - throttle('throttle_authenticated_web', Gitlab::Throttle.authenticated_web_options) do |req| - if req.web_request? && - Gitlab::Throttle.settings.throttle_authenticated_web_enabled - req.authenticated_user_id([:api, :rss, :ics]) - end - end - - throttle('throttle_unauthenticated_protected_paths', Gitlab::Throttle.protected_paths_options) do |req| - if req.post? && - !req.should_be_skipped? && - req.protected_path? && - Gitlab::Throttle.protected_paths_enabled? && - req.unauthenticated? - req.ip - end - end - - throttle('throttle_authenticated_protected_paths_api', Gitlab::Throttle.protected_paths_options) do |req| - if req.post? && - req.api_request? && - req.protected_path? && - Gitlab::Throttle.protected_paths_enabled? - req.authenticated_user_id([:api]) - end - end - - throttle('throttle_authenticated_protected_paths_web', Gitlab::Throttle.protected_paths_options) do |req| - if req.post? && - req.web_request? && - req.protected_path? && - Gitlab::Throttle.protected_paths_enabled? - req.authenticated_user_id([:api, :rss, :ics]) - end - end - - safelist('throttle_bypass_header') do |req| - Gitlab::Throttle.bypass_header.present? && - req.get_header(Gitlab::Throttle.bypass_header) == '1' - end - - class Request - def unauthenticated? - !(authenticated_user_id([:api, :rss, :ics]) || authenticated_runner_id) - end - - def authenticated_user_id(request_formats) - request_authenticator.user(request_formats)&.id - end - - def authenticated_runner_id - request_authenticator.runner&.id - end - - def api_request? - path.start_with?('/api') - end - - def api_internal_request? - path =~ %r{^/api/v\d+/internal/} - end - - def health_check_request? - path =~ %r{^/-/(health|liveness|readiness)} - end - - def product_analytics_collector_request? - path.start_with?('/-/collector/i') - end - - def should_be_skipped? - api_internal_request? || health_check_request? - end - - def web_request? - !api_request? && !health_check_request? - end - - def protected_path? - !protected_path_regex.nil? - end - - def protected_path_regex - path =~ protected_paths_regex - end - - private - - def request_authenticator - @request_authenticator ||= Gitlab::Auth::RequestAuthenticator.new(self) - end - - def protected_paths - Gitlab::CurrentSettings.current_application_settings.protected_paths - end - - def protected_paths_regex - Regexp.union(protected_paths.map { |path| /\A#{Regexp.escape(path)}/ }) - end - end -end - -::Rack::Attack.extend_if_ee('::EE::Gitlab::Rack::Attack') -::Rack::Attack::Request.prepend_if_ee('::EE::Gitlab::Rack::Attack::Request') +Gitlab::RackAttack.configure(::Rack::Attack) diff --git a/config/initializers/rack_attack_logging.rb b/config/initializers/rack_attack_logging.rb index e89c6b1b794..7b0a8f0d7dd 100644 --- a/config/initializers/rack_attack_logging.rb +++ b/config/initializers/rack_attack_logging.rb @@ -6,7 +6,7 @@ ActiveSupport::Notifications.subscribe(/rack_attack/) do |name, start, finish, r req = payload[:request] case req.env['rack.attack.match_type'] - when :throttle, :blocklist + when :throttle, :blocklist, :track rack_attack_info = { message: 'Rack_Attack', env: req.env['rack.attack.match_type'], diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb index 8e3241a2e4c..43beae3f50d 100644 --- a/config/initializers/sidekiq.rb +++ b/config/initializers/sidekiq.rb @@ -46,6 +46,8 @@ Sidekiq.configure_server do |config| config.client_middleware(&Gitlab::SidekiqMiddleware.client_configurator) + config.death_handlers << Gitlab::SidekiqDeathHandler.method(:handler) + config.on :startup do # Clear any connections that might have been obtained before starting # Sidekiq (e.g. in an initializer). diff --git a/config/initializers/structure_load_in_transaction.rb b/config/initializers/structure_load_in_transaction.rb new file mode 100644 index 00000000000..7b8f0e07203 --- /dev/null +++ b/config/initializers/structure_load_in_transaction.rb @@ -0,0 +1,9 @@ +# frozen_string_literal: true + +ActiveRecord::Tasks::DatabaseTasks.structure_load_flags ||= [] + +flag = '--single-transaction' + +unless ActiveRecord::Tasks::DatabaseTasks.structure_load_flags.include?(flag) + ActiveRecord::Tasks::DatabaseTasks.structure_load_flags << flag +end diff --git a/config/initializers/zz_metrics.rb b/config/initializers/zz_metrics.rb index 8e31e4f9282..430e4d60d61 100644 --- a/config/initializers/zz_metrics.rb +++ b/config/initializers/zz_metrics.rb @@ -150,12 +150,6 @@ if Gitlab::Metrics.enabled? && !Rails.env.test? && !(Rails.env.development? && d config.middleware.use(Gitlab::Metrics::ElasticsearchRackMiddleware) end - Sidekiq.configure_server do |config| - config.server_middleware do |chain| - chain.add Gitlab::Metrics::SidekiqMiddleware - end - end - # This instruments all methods residing in app/models that (appear to) use any # of the ActiveRecord methods. This has to take place _after_ initializing as # for some unknown reason calling eager_load! earlier breaks Devise. |